US20090190479A1 - Methods, systems and apparatus for monitoring and/or generating communications in a communications network - Google Patents

Methods, systems and apparatus for monitoring and/or generating communications in a communications network Download PDF

Info

Publication number
US20090190479A1
US20090190479A1 US12/315,752 US31575208A US2009190479A1 US 20090190479 A1 US20090190479 A1 US 20090190479A1 US 31575208 A US31575208 A US 31575208A US 2009190479 A1 US2009190479 A1 US 2009190479A1
Authority
US
United States
Prior art keywords
module
signals
engine
analyser
information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
US12/315,752
Other versions
US8179803B2 (en
Inventor
Brian Parsons
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Advanced Media Systems Ltd
Original Assignee
Advanced Media Systems Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from PCT/NZ2007/000112 external-priority patent/WO2008097105A1/en
Application filed by Advanced Media Systems Ltd filed Critical Advanced Media Systems Ltd
Assigned to ADVANCED MEDIA SYSTEMS LIMITED reassignment ADVANCED MEDIA SYSTEMS LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: PARSONS, BRIAN
Assigned to ADVANCED MEDIA SYSTEMS LIMITED reassignment ADVANCED MEDIA SYSTEMS LIMITED CORRECTED RECORDATION FORM COVER SHEET TO CORRECT THE ATTORNEY DOCKET NUMBER IN REEL 022499 FRAME 0879. Assignors: PARSONS, BRIAN
Publication of US20090190479A1 publication Critical patent/US20090190479A1/en
Application granted granted Critical
Publication of US8179803B2 publication Critical patent/US8179803B2/en
Expired - Fee Related legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04MTELEPHONIC COMMUNICATION
    • H04M3/00Automatic or semi-automatic exchanges
    • H04M3/22Arrangements for supervision, monitoring or testing
    • H04M3/2281Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00Data switching networks
    • H04L12/02Details
    • H04L12/14Charging, metering or billing arrangements for data wireline or wireless communications
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00Arrangements for monitoring or testing data switching networks
    • H04L43/18Protocol analysers
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/30Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information

Definitions

  • the present invention relates to methods, apparatus and systems for monitoring and/or generating communications in a communications network.
  • the communications may include wired and/or wireless communications which may be used for the transfer of voice and/or data. More particularly, embodiments of the invention provide for lawful interception of communications and/or the collection of information regarding communications and/or the generation of communications.
  • the Open Systems Interconnection (OSI) reference model provides a set of protocols that defines and standardises the data communications process to establish a networking framework which facilitates the exchange or transfer of information from a first application to a second application through a network medium, where the first and second applications may reside or operate in first and second nodes or stations, respectively, typically computing devices.
  • OSI Open Systems Interconnection
  • the OSI model provides for implementing protocols in seven layers so that the transfer of information is broken down into smaller, more manageable tasks, with each layer being assigned a subset of these tasks. Each layer is reasonably self-contained so that the tasks assigned to each layer can be implemented independently.
  • the seven layers are specified below:
  • the top three layers may be grouped together as they provide the application services required for the exchange of information in that they allow two applications to interact with each other through the services provided by their respective operating systems.
  • the bottom four layers or data transport layers may also be grouped together, with these four layers providing the end-to-end services necessary for data exchange between two systems using protocols associated with the communications network used to link the two nodes together.
  • any given layer will communicate with three other layers—the layers immediately above and below, as well as the peer layer in other networked systems.
  • the services provided by adjacent layers help a given OSI layer communicate with its peer layer, which is important because the information exchange process occurs between peer layers.
  • each OSI layer adds control information to the data or information to be exchanged, whereas the destination system analyses and removes the control information from the data.
  • the origination system works from the application layer to the physical layer, adding control information at each layer, whereas the destination system works from the physical layer to the application layer, extracting control information at each layer so as to arrive at the original data.
  • the physical layer defines the electrical, mechanical, procedural and functional specifications for activating, maintaining and deactivating the physical link between communication network systems. It is responsible for any encoding scheme, defines physical aspects such as cables and cards, provides electrical and mechanical interfaces for a network and specifies how signals are to be transmitted on the network.
  • the data link layer provides for the reliable transit of data across a physical network link by defining network and protocol characteristics, including physical addressing which enables multiple devices to uniquely identify one another at the data link layer.
  • the data link layer controls frame synchronisation, flow control and error checking.
  • the network layer defines the network address (as opposed to the physical address) and provides switching and routing technologies to create logical paths for transmitting from node to node.
  • the layer also controls error handling, congestion control and packet sequencing.
  • the transport layer provides for the transparent transfer of data between end systems or hosts and is responsible for end-to-end error recovery and flow control, thereby ensuring complete data transfer.
  • the session layer establishes, manages and terminates communication sessions.
  • the presentation layer works to transform data into the form that the application layer can accept so that the information or data sent from the application layer of one system is readable by the application layer of another system.
  • This layer formats and encrypts data to be sent across a network providing freedom from compatibility problems.
  • the application layer supports application and end user processes by interacting with software applications that implement a communicating component. Functions of this layer include identifying communication partners and quality of service, considering user authentication and privacy, determining resource availability and synchronising communication.
  • Protocol stacks are particular implementations (usually in software) of a protocol suite. Protocol stacks are often divided into media, transport and application sections or layers with interfaces, defined by software provided between the media and transport layers and the transport and application layers.
  • the media/transport interface defines how protocol software makes use of particular media and hardware types (e.g. card drivers). For example, this interface may define how TCP/IP transport software talks to Ethernet hardware.
  • the application/transport interface specifies how application programs make use of the transport layers. For example, this interface may define how a web browser program talks to TCP/IP transport software.
  • Telecommunications service providers have been requested to facilitate the lawful interception of telephone calls and other transfers of information over their networks so as to enable authorised organisations, such as law enforcement agencies, to monitor and intercept communications by individuals under investigation.
  • US 2004/0165709 A1 describes the interception of calls within a Voice over Internet Protocol or VoIP network.
  • the VoIP network includes a switch that offers IP-based telephony services for subscribers over a packet network.
  • Packet interceptors are deployed in the packet network to non-intrusively monitor the signalling and media packets, which comprise a call in a VoIP network.
  • a call monitoring engine notifies the packet interceptors to monitor for any activity on the VoIP network for a specific telephone.
  • the packet interceptors then isolate and filter packets based on standard VoIP signalling protocols.
  • the packet interceptors forward voice packets to a voice packet receiver and assembler, which buffers and re-transmits the media stream to a law enforcement agency over a secure channel.
  • US 2002/0078384 A1 describes an interception method and system for a packet network, such as a GPRS (General Packet Radio Service) or UMTS (Universal Mobile Telecommunications System) network.
  • a first network element is provided for intercepting data packets in a packet network. The first network element reads headers of data packets and uses this information to select whether or not to intercept a particular packet. Packets selected for interception are duplicated and sent to an interception gateway element (as well as the packet network), which in turn forwards the packets to an intercepting authority.
  • GPRS General Packet Radio Service
  • UMTS Universal Mobile Telecommunications System
  • US 2005/0094651 A1 describes a lawful interception gateway which receives RTP/IP packets comprising the content of an intercepted communication between two or more users of a communication network from a media gateway.
  • the media gateway transmits interception related information and the corresponding communication content to a monitoring facility.
  • U.S. Pat. No. 5,913,161 describes lawful interception of cellular communications. Communications are copied at the interface to a base station subsystem. Control information is continuously monitored so as to identify target identification numbers of called and calling parties. Upon finding a target number, the copy of the relevant channel is forwarded to a monitoring station.
  • EP 1 484 892 A2 describes lawful interception of packet switched network services. Interception functionality is provided at a switch, which may be any node in the network where data packets, including packets that contain the user ID of a subscriber to the network, can be intercepted. On attempting to log on, the user ID is compared to a list of target user IDs and, if there is a match, a copy of the communications is forwarded to a monitoring station.
  • a module for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes comprising an engine for receiving the plurality of signals over the network, for extracting protocol data therefrom and for providing the extracted protocol data to an analyser; and a processor for controlling operation of the engine and the analyser.
  • the module is adapted to divide signals between a respective first node and second node into a plurality of planes and to separately process each plane.
  • the module is adapted to divide the signals into three planes.
  • a first plane comprises the access side TRANSPORT plane which carries the user's payload (sms, voice, video, internet data etc) to the carrier's CO exchange for switching and routing over the telco's network. eg: Radio link, phone line, DSL line, PABX trunks Ethernet etc.
  • the module preferably simultaneously processes the transport layer on the access side of the network for call processing and the network side for internal management functions such as redundancy and system reliability.
  • a second plane comprises call control information and/or network call signalling and may be referred to as the CONTROL plane.
  • the module processes the control plane on both the access and core networks, depending on the carrier and the user device.
  • a third plane comprises user plane traffic and may be referred to as the USER plane.
  • This plane is primarily concerned with user generated content e.g. voice, data etc, but may contain call control signalling and/or network information generated by user applications, depending on service protocols.
  • the module preferably processes the user plane on both the access and core networks.
  • the module is configured to process the user and/or network control signalling and the control information to control processing of the user plane traffic.
  • each plane is processed substantially simultaneously.
  • the three planes are used to functionally group a particular signal's protocol layers.
  • the planes are then preferably divided into two sections: access and core.
  • the access section connects the user to the, for example, telco network (wireline, local loop, cellular, RAN etc) and the core section consists of the carriers' infrastructure switches.
  • telco network wireless local loop, cellular, RAN etc
  • the core section consists of the carriers' infrastructure switches.
  • Particular call, session and/or user (including subscriber and/or device) identities may be generated and/or be simultaneously present in one or more of the three planes.
  • the units of information processed in a plane may be referred to as a PDU or Plane Data Unit. Calls received which do not have the particular identity may be immediately discarded.
  • the PDU information content of each layer described above is only indicative of what would typically be expected and there is a high degree of overlap particularly between the CONTROL and USER planes, especially in wireless networks.
  • the module engine applies a weight to the PDU to facilitate high speed processing efficiency, provide a mechanism for real-time adaptation of the executing engine code and ensure reliable content delivery.
  • each plane processes and assigns a weighting to the PDU (call component signalling) it receives and/or generates in combination with the previous plane weighting (if present) and local system parameters which contribute to system processing.
  • the PDU weighting reflects the section (access, core), wireless/fixed technology, handling complexity, density, payload QoS, system processing intensity etc.
  • the module engine code cycle operation applies a native and very natural logical centrifugal force to the weighted PDU's. This force aligns the PDU with upper plane particular control processing such as exception handling or delivery routing changes for QoS to external systems.
  • embodiments of the invention enable real-time processing of communications by performing initial processing on only a portion of the data that makes up any given communication, namely user and/or network call signalling and/or transport information. More time and/or processor intensive operations may then only be performed for a subset of communications. However, through the use of the protocol information, routing and the control of the state of communications during processing is ensured.
  • the module comprises means for duplicating the plurality of signals to form two or more sets of substantially identical signals.
  • the means for duplicating comprises one or more of a tap, a mirror or a splitter.
  • the means for duplicating may not be included with in the module but as an external component communicatively coupled thereto.
  • the engine is configured to receive the first set of said signals.
  • the module is configured to transparently transport the second set of signals such that each signal is conveyed to its respective destination node.
  • the engine is adapted to extract protocol data from each of the plurality of signals (more particularly, each PDU) and form an engine CDC (Centrifuge Data Control) set or hash set for each said signal, each engine data set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
  • the engine may then apply a weight to the PDU, as described hereinabove.
  • the engine is located remote from the analyser and/or the processor but communicatively coupled thereto.
  • the analyser is located remote from the processor but communicatively coupled thereto.
  • any two or more of the engine, analyser and processor may be integrated.
  • the processor is adapted to receive one or more mode signals which determine the functional characteristics of the module.
  • the processor is adapted to receive a mode signal from a user entry device.
  • the processor is adapted to relay a first set of control parameters to the analyser in response to a mode signal.
  • the analyser is adapted to relay a second set of control parameters to the engine in response to the first set of control parameters.
  • the processor is adapted to relay a second set of control parameters to the engine in response to a mode signal.
  • the processor is adapted to relay the second set of control parameters to the engine via the analyser.
  • the analyser is adapted to modify the second set of control parameters prior to relaying said parameters to the engine.
  • the analyser is adapted to extract operational parameters from a database in response to the first set of control parameters.
  • the engine is adapted to extract operational parameters from a database in response to the second set of control parameters.
  • a mode signal may indicate a lawful interception mode of operation with the module being adapted to receive an identifier identifying one or more signals to be intercepted.
  • the analyser is configured to locate the one or more signals from the plurality of signals using the identifier and the extracted protocol data. More particularly, the analyser may search the extracted protocol data for instances of the identifier.
  • the identifier comprises a user identifier and/or a user device identifier associated with one or more of said signals.
  • the identifier may comprise one or more of a telephone number, a unique device or port identifier, a username, a login name, an email address, a URL, a service identifier or a category/type of service identifier.
  • the type of identifier is not important and will depend on the particular application of the invention. Any identifier may be used which serves to selectively identify the desired subset of communications.
  • the module is adapted to receive the identifier from a database.
  • the database may form part of the module.
  • Identifiers may be received via a user entry device, such as a keyboard.
  • the module comprises a memory for storing at least a portion of the intercepted signal and/or information obtained therefrom.
  • the module comprises a transmitter for transmitting at least a portion of the intercepted signal and/or information obtained therefrom to a remote node, in which case, the module preferably comprises means for encrypting the at least a portion of the intercepted signal and/or information obtained therefrom prior to transmission.
  • the remote node is located at or is in the control of a law enforcement agency.
  • the analyser is adapted to generate an analysis hash set for each signal to be intercepted, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set and/or the associated user traffic to the remote node.
  • a mode signal may indicate an information gathering mode of operation.
  • the analyser is preferably configured to gather information from at least a portion of the signals, such as for the purpose of billing users/customers.
  • lawful interception mode and the information mode may operate concurrently and, according to particular embodiments of the invention, the information gathering may be performed for intercepted communications.
  • the analyser is configured to extract details of the originating and/or destination nodes; and/or a duration of the communication and/or an amount of data exchanged between the two nodes; and/or a type or category of service information.
  • the analyser is adapted to format the information for transmission to a billing authority.
  • the billing authority may be a telecoms operator and/or an internet service provider.
  • the analyser is preferably adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the billing authority.
  • the module may be configured to gather information for testing and/or diagnostic purposes.
  • the analyser is preferably configured to derive one or more statistics relating to at least a portion of the signals.
  • the analyser is adapted to format the information for transmission to a remote station.
  • the analyser is adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the remote station.
  • the remote station is located at or under the control of a telecommunications company and/or an internet service provider and/or a network operator.
  • the module may concurrently operate in more than one mode.
  • the lawful interception mode may operate as the module is performing other data gathering processes.
  • an apparatus for generating communications to be sent to one or more destination nodes in a communications network comprising an engine communicatively coupled to an analyser; a processor communicatively coupled to the engine and the analyser; and a database, wherein the processor is configured to transmit control signals to the engine and/or the analyser, and in response thereto, the engine and the analyser are configured to generate and route communications to the destination nodes using parameters from the database.
  • the engine and the analyser are configured to generate protocol data for the communications based on the parameters, thereby enabling routing of the communications to their respective destination nodes.
  • the parameters comprise one or more of a username, an e-mail address, a telephone number, a unique device identifier, details of the transfer media to the respective destination nodes or a type of device identifier.
  • the apparatus comprises a memory for storing user traffic, wherein the apparatus is configured to extract and associate at least a portion of the user traffic to each generated communication.
  • the user traffic comprises voice and/or data traffic.
  • the apparatus comprises means for generating the user traffic.
  • the analyser is configured to generate an analysis hash set for each communication in response to the control signals using parameters extracted from the database.
  • the engine is configured to generate engine hash or data sets in response to the control signals and using the analysis hash sets.
  • the analysis and engine hash sets contain protocol and control data which enable the generated communications to be appropriately routed.
  • the apparatus of the second aspect may contain the module of the first aspect, such that the module gathers information regarding the generated communications.
  • the elements of the apparatus of the second aspect may be the same as those of the module of the first aspect such that the same elements perform both the data gathering and call generation roles.
  • the apparatus of the second aspect provides the reverse functionality of many of the components of the first aspect.
  • the apparatus of the second aspect provides a means for generating communications so as to, for example, test at least portions of a communications network by providing data on that network.
  • the invention enables this testing to be based on data that is akin to real data transferred over a network, but without the risk associated therewith.
  • means for routing the communications from the apparatus of the second aspect are provided so as to enable the communications to be presented to a particular network.
  • Such means may include one or more of a tap, mirror or splitter.
  • a communications system comprising the module of the first aspect and/or the apparatus of the second aspect.
  • a method for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes comprising receiving the plurality of signals over the network at an engine; extracting protocol data from the received signals and providing the extracted protocol data to an analyser; and controlling operation of the engine and analyser using a processor.
  • the method comprises dividing the signals between a respective first node and second node into a plurality of planes and separately processing each plane. More preferably, the signals are divided into three planes. Namely, the planes defined in relation to the first aspect.
  • the method comprises processing the user and/or network control signalling and the control information to control processing of the user plane traffic.
  • each plane is processed substantially simultaneously.
  • each signal of the second set of signals may be relayed to its corresponding destination through the module or apparatus of the invention in, or substantially in, real-time such that a user at the destination node is unaware of any delay.
  • This is particularly important for lawful interception applications since it is vital that parties to the communications being monitored are unaware of the interceptions. More generally, though, it avoids inconveniencing users and loss of connections.
  • the method comprises duplicating the plurality of signals to form two or more sets of substantially identical signals, wherein a first set of signals is processed according to the method of the fourth aspect and a second set of signals is transparently transported such that each signal is conveyed to its respective destination node.
  • the method comprises extracting protocol data from each of the plurality of signals and forming an engine hash set or an engine CDC (Centrifuge Data Control) set for each said signal, each engine hash set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
  • engine CDC Chiptrifuge Data Control
  • the method may further comprise adding a weight, as described hereinabove in relation to the first aspect.
  • the method comprises receiving one or more mode signals.
  • a first set of control parameters is relayed from the processor to the analyser in response to a mode signal.
  • a second set of control parameters may be relayed from the analyser to the engine in response to the first set of control parameters or directly passed from the processor to the engine.
  • the second set of control parameters may be relayed from the processor to the engine via the analyser, in which case, the analyser may modify the parameters prior to relaying them to the engine.
  • operational parameters are extracted from a database in response to the first set of control parameters and/or the second set of control parameters.
  • a mode signal may indicate a lawful interception mode of operation and an identifier (or a plurality of identifiers) may be received identifying one or more signals to be intercepted.
  • the one or more signals from the plurality of signals are located using the identifier and the extracted protocol data.
  • the identifier is received from a database.
  • the identifier may be received directly from a user entry device directly or via the database.
  • At least a portion of the intercepted signal and/or information obtained therefrom is stored and/or transmitted.
  • the at least a portion of the intercepted signal and/or information obtained therefrom is encrypted prior to transmission.
  • the method comprises generating an analysis hash set for each signal to be intercepted, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set and/or the associated user traffic to the remote node.
  • a mode signal may indicate an information gathering mode, in which case, the method preferably comprises gathering information from at least a portion of the signals in response to the mode signal.
  • the gathering of information may be for billing purposes, in which case, details of the originating and/or destination nodes; and/or a duration of the communication and/or an amount of data exchanged between the two nodes; and/or a type or category of service information may be extracted.
  • the information may be formatted for transmission and transmitted to a billing authority.
  • an analysis hash set is generated for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the billing authority.
  • the gathering of information may be for testing and/or diagnostic purposes, in which case, one or more statistics may be derived which relate to at least a portion of the signals.
  • the information may be formatted for transmission and transmitted to a remote station.
  • an analysis hash set is generated for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the remote station.
  • a method of generating communications to be sent to one or more destination nodes in a communications network comprising transmitting control signals from a processor to an engine and/or an analyser, the engine being communicatively coupled to the analyser; and in response thereto, generating and routing communications to the destination nodes using parameters from the database by the engine and the analyser.
  • the generating comprises generating protocol data for the communications based on the parameters, thereby enabling routing of the communications to their respective destination nodes.
  • stored user traffic is used for the communications, wherein at least a portion of the user traffic is extracted and associated to each generated communication.
  • the user traffic may be generated as required, either locally or remotely.
  • an analysis hash set is generated for each communication in response to the control signals using parameters extracted from the database.
  • engine hash sets are generated in response to the control signals and using the analysis hash sets.
  • Information regarding communications generated using the method of the fifth aspect may be gathered using the method of the fourth aspect.
  • FIG. 1 is a telecommunications architecture having three planes according to an embodiment of the invention
  • FIG. 2 a is a schematic representation of a system of an embodiment of the invention.
  • FIG. 2 b is a schematic representation of a system of an embodiment of the invention, similar to that of FIG. 2 a but providing additional detail;
  • FIG. 3 is a schematic representation of a first module of the invention and its interface with a second module
  • FIG. 4 is a schematic representation of a second module of the invention and its interfaces with the first module and a third module;
  • FIG. 5 is a schematic representation of the third module of the invention and its interfaces with a second module and end users;
  • FIG. 6 is an end-to-end schematic representation of a system according to an embodiment of the invention.
  • All service providers including wired and/or wireless telecommunications companies (Telcos) and Internet service providers (ISPs), offer their subscribers many individually piped services and applications. As well as providing for the transfer of voice and/or data and/or information, authentication, billing and access to third-party application servers must also, for example, be performed. These services or applications may be integral to network switching and routing elements but the specific architecture and connecting technologies will depend on the Telco and the vendor equipment chosen.
  • Each application or service deployed by a service provider is made up of many protocol stacks. Each stack may be described in terms of the OSI reference model described hereinbefore. Between origination and destination nodes, each layer may be transformed or adapted depending on the service provider's architecture and the carrier technology deployed. There is a wide range of connecting technologies, interfaces and architectures to deliver a service provider's application, some based on standards and others proprietary to the vendor supplying the equipment or application involved. Thus, additional layers may be included and/or some layers of the OSI model may be altered or omitted.
  • Embodiments of the present invention provide apparatus, systems and methods that are able to operate in various environments and thereby enable service providers to move towards a more converged view whilst maintaining and supporting an existing customer base and legacy services. This is enabled using data obtained from the various OSI layers or protocol stacks which may be performed for any type of communication, as will become apparent from the description below.
  • the physical location of the application of the present invention within a communications system or network depends on its particular use and deployment model.
  • the engine is located at an access aggregation point on the access side of the core network such that there is access for the apparatus of the invention to all or a desired portion of communications in the network.
  • Embodiments of the invention do not require changes to any of the hardware modules present in existing networks because whilst the module of the present invention may be included in an access aggregation point such as a switch, it is preferably provided upstream or downstream thereof so that it may receive all or a subset of the communications to and from the switch but does not require modifications to be made to the switch.
  • embodiments of the present invention provide an application that is independent of vendor equipment, functionally holistic in access and core network switching technologies and capable of transparent, real-time operation.
  • FIG. 1 shows a telecommunications architecture 1 having three planes 12 , 13 , 14 .
  • the standard OSI reference model may apply in whole or in part (i.e., all or a subset of the OSI layers may be used for each plane 12 , 13 , 14 ).
  • Planes 12 , 13 , 14 are configured such that the user/network signalling, control data and user traffic may be carried over physically separate bearer and/or transport technologies.
  • First plane 12 (shown in light blue in FIGS. 1 to 5 ) is responsible for user traffic such as voice, data, applications and services.
  • Second plane 13 (shown in light green in FIGS. 1 to 5 ) is responsible for control data.
  • Third plane 14 (shown in light orange in FIGS. 1 to 5 ) is responsible for transport or user/network signalling. All planes 12 , 13 , 14 work together simultaneously to enable communications to and from a user or subscriber device 15 . Typically, each plane interacts with the others and this interaction has many interfaces, each with its own particular protocol stacks. The application logic of the present invention maintains state for processing between planes, interfaces and protocols.
  • the invention processes user/network call signalling and control data, thereby permitting the tracking of, analysis on and potential subsequent action on user plane traffic.
  • the invention finds particular application to lawful interception of communications involving an identifier such as that for a particular user, service or any other identifier that may be selected.
  • the identifier may be compared with information in the control data plane 13 and/or user/network signalling plane 14 , with operations (e.g. routing of the user plane traffic to a law enforcement agency) only being performed if required.
  • Embodiments of the invention may also be used for data extraction purposes by identifying service users (such as calling and/or called parties in a telecommunications network), details of the communications (e.g. length of time for a communication and/or amount of data exchanged) and/or details of the type of service.
  • the information obtained may be used for billing customers as well as in capacity planning and diagnostics.
  • Capacity planning and diagnostics functionality may be provided using real communications over the network.
  • embodiments of the invention provide for simulated call generation for this purpose so as to enable more rapid testing of network functionality.
  • the call generation and data extraction functionalities are preferably provided in the same module using the same key components. However, the invention is not limited thereto and separate components may be used in the same module or separate modules may be used for each purpose.
  • the apparatus of the present invention is made up of three basic modules, an engine, an analyser and a processor, each of which may be implemented in hardware and/or software.
  • the functions of each module are such that they support centralised or distributed processing, wherein the functions may be performed by a single element or split over a plurality of elements.
  • the particular configuration selected is not material to the invention and the skilled man would be readily able to select a particular configuration depending on performance requirements. It is therefore intended that all such configurations be included within the scope of the invention.
  • subscriber 15 typically makes use of the service providers access, core and service applications networks 17 , 18 .
  • the real-time logic of the present invention understands the protocols between the various elements and extracts information therefrom. This is applied to processing for the user or service as required. Connections between plane elements are interfaces that consist of various physical interfaces and protocol stacks.
  • the invention provides for a multi-protocol real-time switching and processing application for wireless and fixed access and core technologies. This provides service providers with direct real-time processing of all user activity and applications present on their network. This processing may be on a particular subscriber or on a service used by many subscribers.
  • FIG. 2 a shows a schematic representation of a system 20 according to an embodiment of the invention.
  • the application of the invention comprises three modules. These are engine module 21 , analysis module 22 and process module 23 .
  • the modules work together to provide carriers complete visibility of the user/network signalling and payload traffic flowing over their networks.
  • Modules 21 , 22 and 23 are communicatively coupled to database 24 which holds unique subscriber or application service identifiers.
  • database 24 which holds unique subscriber or application service identifiers.
  • the real-time processing of the invention of access and core network interfaces and protocols allows for an array of user or service specific identifiers, such as telephone numbers, login names, Internet service provider (ISP) homepages etc.
  • ISP Internet service provider
  • the identifiers may depend on the technology or may be common to the service.
  • embodiments of the invention are able to operate regardless of the vendor equipment deployed by a
  • Engine module 21 applies fixed and wireline protocol analysis and creates hash sets of current subscriber calls application services and their particular states along with other information such as statistics to analysis module 22 . Record sets provisioned in database 24 are used to determine which calls and application services are to be processed.
  • analysis module 22 implements fixed and wireless protocol stacks and is fully aware of processes occurring in all seven OSI layers. Analysis module 22 controls the processing logic within engine module 21 based on applications loaded in process module 23 . Unlike engine module 21 which uses the actual signalling provided by the network, the protocol analysis performed by analysis module 22 works on the hash sets provided by engine module 21 which dramatically speeds up the switching and processing of user payloads. Analysis module 22 and engine module 21 work together providing a high-speed switching lane for user plane traffic.
  • Process module 23 provides instructions to analysis module 22 setting the functional characteristics thereof depending on the particular application of the invention. For example, for a capacity planning role (as will be discussed in more detail below), analysis module 22 and engine module 21 only require statistics to be recorded whereas in a lawful interception role, multimedia voice and data is switched in real-time through to the (law enforcement) agencies authorised to make the interceptions.
  • Process module 23 also provides interfaces to the end user, carrier NOC (Network Operations Centre) or other control centre, and/or reporting servers, as applicable, whether data, media or reporting is delivered.
  • Process module 23 has an administration interface whereby an operator can provision IDs or identifiers, URI's (Uniform Resource Identifier) application services (fixed or cellular) etc they would like to troubleshoot, analyse or receive in real-time.
  • IDs or identifiers URI's (Uniform Resource Identifier) application services (fixed or cellular) etc they would like to troubleshoot, analyse or receive in real-time.
  • FIG. 2 b is a schematic representation showing functionality according to a preferred embodiment of the invention.
  • the module is preferably adapted to divide signals between a respective first node and second node into a plurality of planes and to separately process each plane. More preferably, signals are divided into three planes: transport, control and user planes.
  • the access side TRANSPORT plane carries the user's payload (sms, voice, video, internet data etc) to the carrier's CO exchange for switching and routing over the telco's network. eg: Radio link, phone line, DSL line, PABX trunks Ethernet etc.
  • the module preferably simultaneously processes the transport layer on the access side of the network for call processing and the network side for internal management functions such as redundancy and system reliability.
  • the CONTROL plane includes call control information and/or network call signalling.
  • the module processes the control plane on both the access and core networks, depending on the carrier and the user device.
  • the USER plane includes user plane traffic. This plane is primarily concerned with user generated content e.g. voice, data etc, but may contain call control signalling and/or network information generated by user applications, depending on service protocols.
  • the module preferably processes the user plane on both the access and core networks.
  • the three planes are used to functionally group a particular signal's protocol layers.
  • the planes are then preferably divided into two sections: access and core.
  • the access section connects the user to the, for example, telco network (wireline, local loop, cellular, RAN etc) and the core section consists of the carriers' infrastructure switches.
  • telco network wireless local loop, cellular, RAN etc
  • the core section consists of the carriers' infrastructure switches.
  • Particular call, session and/or user (including subscriber and/or device) identities may be generated and/or be simultaneously present in one or more of the three planes.
  • the units of information processed in a plane may be referred to as a PDU or Plane Data Unit. Calls received which do not have the particular identity may be immediately discarded.
  • the PDU information content of each layer described above is only indicative of what would typically be expected and there is a high degree of overlap particularly between the CONTROL and USER planes, especially in wireless networks.
  • the module engine applies a weight to the PDU to facilitate high speed processing efficiency, provide a mechanism for real-time adaptation of the executing engine code and ensure reliable content delivery.
  • each plane processes and assigns a weighting to the PDU (call component signalling) it receives and/or generates (depending on the mode of operation) in combination with the previous plane weighting (if present) and local system parameters which contribute to system processing.
  • the PDU weighting reflects the section (access, core), wireless/fixed technology, handling complexity, density, payload QoS, system processing intensity etc.
  • the module engine code cycle operation applies a native and very natural logical centrifugal force to the weighted PDU's. This force aligns the PDU with upper plane particular control processing such as exception handling or delivery routing changes for QoS to external systems. Details of a preferred weighting scheme are provided in FIG. 2 b . The skilled person will be aware of other weighting schemes and the invention is not limited to the specifics of the scheme shown.
  • the engine may extract protocol data from each signal (more particularly, each PDU) and form an engine CDC (Centrifuge Data Control) set or hash set for each said signal, each engine data set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
  • the engine may then apply a weight to the PDU, as described hereinabove.
  • FIG. 3 is a schematic representation of engine module 21 and its interface with analysis module 22 .
  • Engine module 21 receives signals over any number of interfaces carrying user and/or network control and signalling and user traffic. These interfaces may be physical or logical. For example, they may be VPN (virtual private network) based with VPLS (virtual private LAN service) or MPLS (multiprotocol label switching) encapsulation.
  • the physical transport to the apparatus of the invention may use copper-wire and/or optical fibres and may be adapted to receive and transmit or receive only. All forms of L1 and L2 encapsulation are supported. There is no limit to the call processing capabilities other than the switching and processing limits inherent of the platform on which the application of the invention resides.
  • the engine is designed to process each layer of the particular protocol stack as efficiently as possible through the use of hash sets which are parsed versions of the protocol stacks associated with given communications.
  • Each physical connection contains interfaces having a specific inter-plane connection (see FIG. 1 ) or several interconnections.
  • Interfaces may carry fixed and/or wireless protocol stacks, where the connection is specific to a particular fixed or wireless interface.
  • the Gn interface a GPRS interface located between GPRS support nodes
  • C7 ISUP ISDN user part—a key protocol in the C7/SS7 signalling system
  • Engine module 21 provides the logic to correlate the common and specific interfaces and protocols and has logic to maintain the state between the interfaces and their layers such that communications continue to be relayed in a transparent manner.
  • the invention processes and parses the received fixed and wireless protocol stacks (starting at layer 1 ) in accordance with fixed and wireless protocol signalling standards such as for circuit ITU/ANSI C7 ISUP WB and international Q.769 and cell packet technologies ATM, DSL Frame Relay, IP, cellular etc.
  • fixed and wireless protocol signalling standards such as for circuit ITU/ANSI C7 ISUP WB and international Q.769 and cell packet technologies ATM, DSL Frame Relay, IP, cellular etc.
  • Engine module 21 constructs hash sets (preferably one to two bytes in length but may be up to four bytes) for maintaining protocol and call state information.
  • the hash sets are read and written to via bitwise logic operations and are produced on a per subscriber basis but may be consolidated based on application service, access technology, carrier technology etc.
  • the relevant call signalling is extracted and maintained by way of the hash sets for the purpose of keeping state for subsequent logic.
  • the length of the hash sets depends on the particular layer, interface and plane over which the signalling is occurring.
  • Engine hash sets are produced as a result of protocol analysis which requires particulars of the subscriber or service of interest. These particulars are provided in database 24 and can be changed at anytime during operation of the invention.
  • the records stored in database 24 are of a nature that provides unique call/service identifiers which are groomed and applied to the protocol stacks relevant to the traffic on the inbound interfaces.
  • Gateway Engine module 21 provides common protocol stack switching whereby certain protocol layers are common to many stacks.
  • the HTTP protocol may be accessed via wireless (PDA) or fixed (broadband) networks and there is no need to duplicate this layer. Every layer is carefully maintained for state information and system maintenance purposes and to overcome access and transport connectivity issues such as packet loss and congestion which cause problems in terms of dormant sessions and memory loss.
  • the unique hash sets provide details on the current call state by consolidating details for each relevant interface participating in a particular call or calls, taking account of network congestion and retransmission algorithms and strategies, which is critical particularly for traffic inbound over lossy wireless access networks.
  • What information engine module 21 extracts depends on the technology employed at the particular layer. For example, fixed voice may be carried over different protocols (from layer 1 through to layer 6 ), but layer 7 is still voice (layer 1 could be an E1 or Ethernet)—it depends on the carrier infrastructure. It becomes more complex when wireless (GSM/UMTS (3GPP) vrs CDMA/EVDO (3GPP2)) functionality is added. Engine module 21 understands this variation on a per layer basis and tracks the changes in protocols (layer 1 through to layer 7 ).
  • the input to the hash sets may vary from protocol to protocol and could be atm/vpn identifiers through to session/sequence numbers and cryptographic hashes, basic information specific to the owner/generator/terminator of the communications stream, or simply data that helps in the reassembly of a fragmented traffic stream.
  • the length of the hash sets may vary depending on what is being hashed and they contain bits to identify the protocol owner and stream information to aid in the multiplexing of real-time QoS (Quality of Service) aware traffic.
  • FIG. 4 is a schematic representation of analysis module 22 and its interfaces with engine module 21 and process module 23 .
  • Analysis module 22 controls the processing performed by engine module 21 in accordance with the service instructions received from process module 23 .
  • the instructions it receives depends on the particular application of the invention being performed on the selected call or service. Call and service specific details are read from database 24 .
  • Analysis module 23 provides information to process module 23 , such as call service trace data and call statistics, as well as providing health of system and/or diagnostic data for system logs, alarming and maintenance purposes.
  • Analysis module 22 implements feed-forward towards process module 24 and feed-back towards engine module 21 with the particular information being passed depending on the particular application of the invention. Critical details required to support the particular application are provided in a memory such as database 24 .
  • Call states are maintained through analysis hash sets which are based on the engine hash sets (i.e., the hash sets generated by engine module 21 ) and the instructions received from process module 23 .
  • the analysis hash sets may contain data from the engine hash sets as well as, for example, routing and control information to enable the desired function to be performed (e.g. the correct routing of data to a law enforcement agency when operating in the lawful interception mode or the forwarding of data to a local or remote memory when operating in a diagnostic mode).
  • analysis module 22 simply controls what engine module 21 is looking for in terms of relevant identifiers (whether these identifiers be for lawful interception, billing or other information gathering or call generation). This aids in the real-time multiplexing of media audio/video or any QoS aware traffic and the generation of the appropriate data, which again depends on carrier infrastructure and technologies.
  • FIG. 5 is a schematic representation of process module 23 and its interfaces with analysis module 22 and example end users.
  • Process module 23 provides top level control for the invention in that it adapts and controls the behaviour of engine and analysis modules 21 and 22 depending on the particular application, such as traffic analysis, real time billing, lawful interception etc. Each specific application requires data configuration and details which are provided by database 24 which is preferably readable by all three modules 21 , 22 and 23 .
  • Process module 23 sends instructions to analysis module 22 for tuning and tailoring the protocol analysis stack function.
  • analysis module 22 may similarly tune and tailor the function of engine module 21 .
  • the instructions are on a per call or service basis and do not apply in a global sense, thereby allowing the invention to perform multiple roles simultaneously without interference. For example, communications may be generated in a generation mode and substantially simultaneously recorded for statistical purposes in a capacity planning role.
  • the invention supports real time processing of various communications including standard PSTN voice traffic, soft switch based voice over IP technology and peer to peer technologies such as Skype and the like.
  • An embodiment of the system showing such capabilities is provided in FIG. 6 . Note that the skilled man would be aware of alternative/additional technologies and/or transport media which may be included (other than those specifically shown in FIG. 6 ) and it is intended that all such alternatives/additions be included within the scope of the invention.
  • FIG. 6 shows example system 60 including some of the inventive aspects of the invention, in particular, those relating to lawful interception of communications.
  • Access network 61 wireless network 62 and fixed network 63 enable elements within system 60 to communicate with one another, as would be apparent to one of skill in the art.
  • Other transmission media including via satellites, are also within the scope of the invention.
  • Module 64 of the invention receives all communications, or at least a copy thereof, being transferred across the network (note that reference “BXP” in FIG. 6 is used to highlight the key components of the invention).
  • Relevant communications are intercepted and sent over, for example, virtual private network (VPN) 65 to a remote server 66 .
  • User interface 67 is provided to enable the results to be monitored and also to enable the provision of identifiers into the system so that particular communications may be targeted for interception. Note that server 66 and monitor 67 may be directly coupled to or integral to module 64 .
  • the identifiers are loaded from database 24 and at step 1 , protocol analysis is performed by engine 21 on incoming traffic to determine call technology and state. Hash sets are created for each communication and sent to analysis module 22 .
  • analysis module 22 performs particular functions on the engine hash sets depending on instructions received from process module 23 and identifiers received from database 24 . Based on call state data received from analysis module 22 and the particular role or application the system or method of the invention is selected to perform, further instructions are sent to analysis module 22 for execution at step 3 . Analysis hash sets are created as a result of this processing.
  • the analysis hash sets may be generated for all or a subset of the communications depending on the mode of operation of the invention. For example, in the lawful interception mode, analysis module 22 may identify relevant communications and only generate analysis hash sets for the identified communications.
  • analysis module 22 carries out any instructions received from process module 23 .
  • the instructions may be to connect a high-speed switching socket for media relay or to save signalling and call statistics to a memory and/or a display (not shown). These instructions will depend on the particular role selected to be performed.
  • the hash sets are modified to reflect these instructions.
  • Analysis module 22 may receive instructions to prioritise certain calls and/or services over others at step 5 . Additionally, feedback is provided to engine 21 so that it works with maximum efficiency, such as by deploying ICMP (Internet Control Message Protocol) or ARP (Address Resolution Protocol) filters.
  • engine 21 applies protocol analysis for all OSI layers for every frame or cell. Certain protocols may be filtered for explicitly for either processing or to be dropped.
  • Tuning instructions for engine 21 are provided by analysis module 22 .
  • the instructions received by engine 21 at step 7 may be to connect a high speed media lane to process module 23 , in which case, the connections are made and user plane traffic is relayed through to its destination.
  • the high speed media switching lane requires the use of both the engine and analysis hash sets to ensure that state is maintained for the communications and that they are correctly routed.
  • process module 23 cuts, for example, ASN.1 (Abstract Syntax Notation One) records with details regarding the call or application service for formal reporting into the business.
  • ASN.1 is a formal notation used for describing data transmitted by telecommunications protocols, regardless of language implementation and physical representation of the data, whatever the application, whether complex or simple. It is a language for abstractly describing messages to be exchanged among an extensive range of applications involving the Internet, intelligent network, cellular phones, ground-to-air communications, electronic commerce, secure electronic services, interactive television, intelligent transportation systems, Voice Over IP and others.
  • Analysis module 22 ensures that content reporting, multimedia, rtp, statistics etc are delivered to the provisioned end-point destinations. Receipt of all transactions and communications is preferably confirmed using protocols known to those of skill in the art.
  • Embodiments of the invention do not replace deployed network elements or systems but instead compliment existing systems by performing analysis and relay of traffic transparently (to the originating and destination nodes) and in real time. Thus, no requirements are imposed on the existing infrastructure allowing for deployment of the invention in existing systems.
  • Embodiments of the invention may not only be used for monitoring communications. Additionally or alternatively, embodiments of the invention may be used to generate communications. These embodiments are of particular value when combined with the monitoring systems described hereinbefore because this enables a service provider to quickly and easily test the capabilities of their systems under any desired conditions. Thus, embodiments of the invention may be used to rapidly test new components deployed in a communications network, thereby allowing them to become operational and an active part of the network more quickly but avoiding loss of any actual user traffic.
  • the engine, analyser and processor work together to generate the communications.
  • the processor provides control signals to the engine and/or the analyser, and in response thereto, the engine and the analyser generate and route communications to the desired destination nodes using parameters from a database, such as database 24 in FIG. 2 a .
  • the engine and the analyser generate protocol data for the communications based on the parameters which may include one or more of a username, an e-mail address, a telephone number, a unique device identifier or a type of device identifier.
  • the parameters may also include particulars of the transmission medium.
  • protocol stacks may be generated which enable transmission of the communications.
  • a memory such as database 24 of FIG. 2 a , may store sample user traffic which is appended to the communications.
  • the user traffic may include voice and/or data traffic, applications or services.
  • means are provided for generating the user traffic.
  • the means for generating may be adapted to generate traffic in accordance with parameters previously monitored for the network or a similar network using the monitoring apparatus of the invention. Random generators may be used to mimic variations which are likely to occur within the network. Thus, it is possible to generate traffic which is similar to that which may actually be communicated over the network.
  • one or a plurality of communications streams may be set up between two or more real devices.
  • Protocol layers i.e., header/tail
  • the desired number of calls and technology e.g. fixed/wireless, VoIP, SMS, PTT, voice, etc
  • Appropriate statistics and diagnostics can be performed in real-time or can be recorded for offline analysis of the carrier infrastructure and subsystems (e.g. transmission, billing, IN, etc).
  • the invention is not limited to these applications and the skilled man may be aware of others. It is intended that all such applications be included within the scope of the invention whether they include the extraction of data regarding communications and/or the generation of communications in a communications network.
  • embodiments of the present invention are not limited to one particular type of communication over one particular portion of a network.
  • US 2004/0165709 is limited to a Telco's core IP network, with the interceptor limited to VoIP communications.
  • Embodiments of the invention may process all types of communications on both the access and core networks, thereby guaranteeing interception of any target.
  • the novel approach described herein enables this to be realised despite the potentially huge volumes of data being transported around a network and without causing delays in the transmission of traffic or storing data which is not being legitimately targeted.
  • embodiments of the invention provide for operation at layer 7 , thereby enabling various components of the system to reliably communicate with one another.
  • An additional advantage is that, for example, geographical redundancy may be provided, such as for a telephone number, since embodiments of the invention enable geographical restraints to be removed.

Abstract

A module for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes, the module having an engine for receiving the plurality of signals over the network, for extracting protocol data therefrom and for providing the extracted protocol data to an analyser; and a processor for controlling operation of the engine and analyser. The invention also provides an apparatus for generating communications, systems including the module and/or the apparatus, and corresponding methods.

Description

    FIELD OF THE INVENTION
  • The present invention relates to methods, apparatus and systems for monitoring and/or generating communications in a communications network. The communications may include wired and/or wireless communications which may be used for the transfer of voice and/or data. More particularly, embodiments of the invention provide for lawful interception of communications and/or the collection of information regarding communications and/or the generation of communications.
  • BACKGROUND
  • The Open Systems Interconnection (OSI) reference model provides a set of protocols that defines and standardises the data communications process to establish a networking framework which facilitates the exchange or transfer of information from a first application to a second application through a network medium, where the first and second applications may reside or operate in first and second nodes or stations, respectively, typically computing devices. A description of the OSI model in relation to internetworks is provided in “Designing Cisco Networks”, Teare, Diane, Indianapolis: Cisco Press, July 1999, a copy of which may be found on www.cisco.com.
  • The OSI model provides for implementing protocols in seven layers so that the transfer of information is broken down into smaller, more manageable tasks, with each layer being assigned a subset of these tasks. Each layer is reasonably self-contained so that the tasks assigned to each layer can be implemented independently. The seven layers are specified below:
      • application (layer 7)
      • presentation (layer 6)
      • session (layer 5)
      • transport (layer 4)
      • network (layer 3)
      • data link (layer 2)
      • physical (layer 1)
  • The top three layers, known as the application set of layers (application, presentation and session), may be grouped together as they provide the application services required for the exchange of information in that they allow two applications to interact with each other through the services provided by their respective operating systems. The bottom four layers or data transport layers (transport, network, data link and physical) may also be grouped together, with these four layers providing the end-to-end services necessary for data exchange between two systems using protocols associated with the communications network used to link the two nodes together.
  • Generally, any given layer will communicate with three other layers—the layers immediately above and below, as well as the peer layer in other networked systems. The services provided by adjacent layers help a given OSI layer communicate with its peer layer, which is important because the information exchange process occurs between peer layers.
  • At the originating system, each OSI layer adds control information to the data or information to be exchanged, whereas the destination system analyses and removes the control information from the data. Thus, the origination system works from the application layer to the physical layer, adding control information at each layer, whereas the destination system works from the physical layer to the application layer, extracting control information at each layer so as to arrive at the original data.
  • The physical layer defines the electrical, mechanical, procedural and functional specifications for activating, maintaining and deactivating the physical link between communication network systems. It is responsible for any encoding scheme, defines physical aspects such as cables and cards, provides electrical and mechanical interfaces for a network and specifies how signals are to be transmitted on the network.
  • The data link layer provides for the reliable transit of data across a physical network link by defining network and protocol characteristics, including physical addressing which enables multiple devices to uniquely identify one another at the data link layer. The data link layer controls frame synchronisation, flow control and error checking.
  • The network layer defines the network address (as opposed to the physical address) and provides switching and routing technologies to create logical paths for transmitting from node to node. The layer also controls error handling, congestion control and packet sequencing.
  • The transport layer provides for the transparent transfer of data between end systems or hosts and is responsible for end-to-end error recovery and flow control, thereby ensuring complete data transfer.
  • The session layer establishes, manages and terminates communication sessions.
  • The presentation layer works to transform data into the form that the application layer can accept so that the information or data sent from the application layer of one system is readable by the application layer of another system. This layer formats and encrypts data to be sent across a network providing freedom from compatibility problems.
  • The application layer supports application and end user processes by interacting with software applications that implement a communicating component. Functions of this layer include identifying communication partners and quality of service, considering user authentication and privacy, determining resource availability and synchronising communication.
  • Protocol stacks are particular implementations (usually in software) of a protocol suite. Protocol stacks are often divided into media, transport and application sections or layers with interfaces, defined by software provided between the media and transport layers and the transport and application layers. The media/transport interface defines how protocol software makes use of particular media and hardware types (e.g. card drivers). For example, this interface may define how TCP/IP transport software talks to Ethernet hardware. The application/transport interface specifies how application programs make use of the transport layers. For example, this interface may define how a web browser program talks to TCP/IP transport software.
  • Telecommunications service providers have been requested to facilitate the lawful interception of telephone calls and other transfers of information over their networks so as to enable authorised organisations, such as law enforcement agencies, to monitor and intercept communications by individuals under investigation.
  • US 2004/0165709 A1 describes the interception of calls within a Voice over Internet Protocol or VoIP network. The VoIP network includes a switch that offers IP-based telephony services for subscribers over a packet network. Packet interceptors are deployed in the packet network to non-intrusively monitor the signalling and media packets, which comprise a call in a VoIP network. Following receipt of an interception request, a call monitoring engine notifies the packet interceptors to monitor for any activity on the VoIP network for a specific telephone. The packet interceptors then isolate and filter packets based on standard VoIP signalling protocols. In response to commands from the call monitoring engine, the packet interceptors forward voice packets to a voice packet receiver and assembler, which buffers and re-transmits the media stream to a law enforcement agency over a secure channel.
  • US 2002/0078384 A1 describes an interception method and system for a packet network, such as a GPRS (General Packet Radio Service) or UMTS (Universal Mobile Telecommunications System) network. A first network element is provided for intercepting data packets in a packet network. The first network element reads headers of data packets and uses this information to select whether or not to intercept a particular packet. Packets selected for interception are duplicated and sent to an interception gateway element (as well as the packet network), which in turn forwards the packets to an intercepting authority.
  • US 2005/0094651 A1 describes a lawful interception gateway which receives RTP/IP packets comprising the content of an intercepted communication between two or more users of a communication network from a media gateway. When a communication involving a target user is detected by the media gateway, the media gateway transmits interception related information and the corresponding communication content to a monitoring facility.
  • U.S. Pat. No. 5,913,161 describes lawful interception of cellular communications. Communications are copied at the interface to a base station subsystem. Control information is continuously monitored so as to identify target identification numbers of called and calling parties. Upon finding a target number, the copy of the relevant channel is forwarded to a monitoring station.
  • EP 1 484 892 A2 describes lawful interception of packet switched network services. Interception functionality is provided at a switch, which may be any node in the network where data packets, including packets that contain the user ID of a subscriber to the network, can be intercepted. On attempting to log on, the user ID is compared to a list of target user IDs and, if there is a match, a copy of the communications is forwarded to a monitoring station.
  • There remains a need in the art for a system and/or apparatus and/or method which enables communications of different types to be monitored concurrently, particularly in or approaching real-time.
  • SUMMARY OF THE INVENTION
  • It is an object of the invention to provide an improved system and/or apparatus and/or method for intercepting communications in a communications network.
  • Alternatively, it is an object of the invention to provide a system and/or apparatus and/or method for collecting information regarding one or more communications in a communications network.
  • Alternatively, it is an object of the invention to provide a system and/or apparatus and/or method for generating communications in a communications network.
  • Alternatively, it is an object of the invention to provide at least a useful choice to the public.
  • According to a first aspect of the invention, there is provided a module for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes, the module comprising an engine for receiving the plurality of signals over the network, for extracting protocol data therefrom and for providing the extracted protocol data to an analyser; and a processor for controlling operation of the engine and the analyser.
  • Preferably, the module is adapted to divide signals between a respective first node and second node into a plurality of planes and to separately process each plane.
  • Preferably, the module is adapted to divide the signals into three planes.
  • Preferably, a first plane comprises the access side TRANSPORT plane which carries the user's payload (sms, voice, video, internet data etc) to the carrier's CO exchange for switching and routing over the telco's network. eg: Radio link, phone line, DSL line, PABX trunks Ethernet etc. The module preferably simultaneously processes the transport layer on the access side of the network for call processing and the network side for internal management functions such as redundancy and system reliability.
  • Preferably, a second plane comprises call control information and/or network call signalling and may be referred to as the CONTROL plane. The module processes the control plane on both the access and core networks, depending on the carrier and the user device.
  • Preferably, a third plane comprises user plane traffic and may be referred to as the USER plane. This plane is primarily concerned with user generated content e.g. voice, data etc, but may contain call control signalling and/or network information generated by user applications, depending on service protocols. The module preferably processes the user plane on both the access and core networks.
  • Preferably, the module is configured to process the user and/or network control signalling and the control information to control processing of the user plane traffic.
  • Preferably, each plane is processed substantially simultaneously.
  • According to particular embodiments of the invention, the three planes are used to functionally group a particular signal's protocol layers. The planes are then preferably divided into two sections: access and core. The access section connects the user to the, for example, telco network (wireline, local loop, cellular, RAN etc) and the core section consists of the carriers' infrastructure switches. Particular call, session and/or user (including subscriber and/or device) identities may be generated and/or be simultaneously present in one or more of the three planes. The units of information processed in a plane may be referred to as a PDU or Plane Data Unit. Calls received which do not have the particular identity may be immediately discarded.
  • The PDU information content of each layer described above is only indicative of what would typically be expected and there is a high degree of overlap particularly between the CONTROL and USER planes, especially in wireless networks.
  • Preferably, the module engine applies a weight to the PDU to facilitate high speed processing efficiency, provide a mechanism for real-time adaptation of the executing engine code and ensure reliable content delivery.
  • Preferably, on a per call basis, each plane processes and assigns a weighting to the PDU (call component signalling) it receives and/or generates in combination with the previous plane weighting (if present) and local system parameters which contribute to system processing. The PDU weighting reflects the section (access, core), wireless/fixed technology, handling complexity, density, payload QoS, system processing intensity etc. For traffic identified and not discarded and/or generated the module engine code cycle operation applies a native and very natural logical centrifugal force to the weighted PDU's. This force aligns the PDU with upper plane particular control processing such as exception handling or delivery routing changes for QoS to external systems.
  • Thus, embodiments of the invention enable real-time processing of communications by performing initial processing on only a portion of the data that makes up any given communication, namely user and/or network call signalling and/or transport information. More time and/or processor intensive operations may then only be performed for a subset of communications. However, through the use of the protocol information, routing and the control of the state of communications during processing is ensured.
  • Preferably, the module comprises means for duplicating the plurality of signals to form two or more sets of substantially identical signals.
  • Preferably, the means for duplicating comprises one or more of a tap, a mirror or a splitter. Note that the means for duplicating may not be included with in the module but as an external component communicatively coupled thereto.
  • Preferably, the engine is configured to receive the first set of said signals.
  • Preferably, the module is configured to transparently transport the second set of signals such that each signal is conveyed to its respective destination node.
  • Preferably, the engine is adapted to extract protocol data from each of the plurality of signals (more particularly, each PDU) and form an engine CDC (Centrifuge Data Control) set or hash set for each said signal, each engine data set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic. The engine may then apply a weight to the PDU, as described hereinabove.
  • Preferably, the engine is located remote from the analyser and/or the processor but communicatively coupled thereto.
  • Preferably, the analyser is located remote from the processor but communicatively coupled thereto.
  • Alternatively, any two or more of the engine, analyser and processor may be integrated.
  • Preferably, the processor is adapted to receive one or more mode signals which determine the functional characteristics of the module.
  • Preferably, the processor is adapted to receive a mode signal from a user entry device.
  • Preferably, the processor is adapted to relay a first set of control parameters to the analyser in response to a mode signal.
  • Preferably, the analyser is adapted to relay a second set of control parameters to the engine in response to the first set of control parameters.
  • Preferably, the processor is adapted to relay a second set of control parameters to the engine in response to a mode signal.
  • Preferably, the processor is adapted to relay the second set of control parameters to the engine via the analyser.
  • Preferably, the analyser is adapted to modify the second set of control parameters prior to relaying said parameters to the engine.
  • Preferably, the analyser is adapted to extract operational parameters from a database in response to the first set of control parameters.
  • Preferably, the engine is adapted to extract operational parameters from a database in response to the second set of control parameters.
  • According to one embodiment, a mode signal may indicate a lawful interception mode of operation with the module being adapted to receive an identifier identifying one or more signals to be intercepted.
  • Preferably, the analyser is configured to locate the one or more signals from the plurality of signals using the identifier and the extracted protocol data. More particularly, the analyser may search the extracted protocol data for instances of the identifier.
  • Preferably, the identifier comprises a user identifier and/or a user device identifier associated with one or more of said signals. For example, the identifier may comprise one or more of a telephone number, a unique device or port identifier, a username, a login name, an email address, a URL, a service identifier or a category/type of service identifier. The type of identifier is not important and will depend on the particular application of the invention. Any identifier may be used which serves to selectively identify the desired subset of communications.
  • Preferably, the module is adapted to receive the identifier from a database. The database may form part of the module.
  • Identifiers may be received via a user entry device, such as a keyboard.
  • Preferably, the module comprises a memory for storing at least a portion of the intercepted signal and/or information obtained therefrom.
  • Preferably, the module comprises a transmitter for transmitting at least a portion of the intercepted signal and/or information obtained therefrom to a remote node, in which case, the module preferably comprises means for encrypting the at least a portion of the intercepted signal and/or information obtained therefrom prior to transmission.
  • Preferably, the remote node is located at or is in the control of a law enforcement agency.
  • Preferably, the analyser is adapted to generate an analysis hash set for each signal to be intercepted, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set and/or the associated user traffic to the remote node.
  • According to one embodiment, a mode signal may indicate an information gathering mode of operation.
  • In response to the mode signal, the analyser is preferably configured to gather information from at least a portion of the signals, such as for the purpose of billing users/customers.
  • It should be noted that the lawful interception mode and the information mode may operate concurrently and, according to particular embodiments of the invention, the information gathering may be performed for intercepted communications.
  • Preferably, the analyser is configured to extract details of the originating and/or destination nodes; and/or a duration of the communication and/or an amount of data exchanged between the two nodes; and/or a type or category of service information.
  • Preferably, the analyser is adapted to format the information for transmission to a billing authority.
  • The billing authority may be a telecoms operator and/or an internet service provider.
  • The analyser is preferably adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the billing authority.
  • Alternatively, the module may be configured to gather information for testing and/or diagnostic purposes. In this case, the analyser is preferably configured to derive one or more statistics relating to at least a portion of the signals.
  • Preferably, the analyser is adapted to format the information for transmission to a remote station.
  • Preferably, the analyser is adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the remote station.
  • Preferably, the remote station is located at or under the control of a telecommunications company and/or an internet service provider and/or a network operator.
  • Again, it should be noted that the module may concurrently operate in more than one mode. Namely, the lawful interception mode may operate as the module is performing other data gathering processes.
  • According to a second aspect, there is provided an apparatus for generating communications to be sent to one or more destination nodes in a communications network, the apparatus comprising an engine communicatively coupled to an analyser; a processor communicatively coupled to the engine and the analyser; and a database, wherein the processor is configured to transmit control signals to the engine and/or the analyser, and in response thereto, the engine and the analyser are configured to generate and route communications to the destination nodes using parameters from the database.
  • Preferably, the engine and the analyser are configured to generate protocol data for the communications based on the parameters, thereby enabling routing of the communications to their respective destination nodes.
  • Preferably, the parameters comprise one or more of a username, an e-mail address, a telephone number, a unique device identifier, details of the transfer media to the respective destination nodes or a type of device identifier.
  • Preferably, the apparatus comprises a memory for storing user traffic, wherein the apparatus is configured to extract and associate at least a portion of the user traffic to each generated communication.
  • Preferably, the user traffic comprises voice and/or data traffic.
  • Preferably, the apparatus comprises means for generating the user traffic.
  • Preferably, the analyser is configured to generate an analysis hash set for each communication in response to the control signals using parameters extracted from the database.
  • Preferably, the engine is configured to generate engine hash or data sets in response to the control signals and using the analysis hash sets.
  • The analysis and engine hash sets contain protocol and control data which enable the generated communications to be appropriately routed.
  • The apparatus of the second aspect may contain the module of the first aspect, such that the module gathers information regarding the generated communications. Moreover, the elements of the apparatus of the second aspect may be the same as those of the module of the first aspect such that the same elements perform both the data gathering and call generation roles. Essentially, the apparatus of the second aspect provides the reverse functionality of many of the components of the first aspect.
  • The apparatus of the second aspect provides a means for generating communications so as to, for example, test at least portions of a communications network by providing data on that network. The invention enables this testing to be based on data that is akin to real data transferred over a network, but without the risk associated therewith.
  • According to one embodiment, in the call generation mode, means for routing the communications from the apparatus of the second aspect are provided so as to enable the communications to be presented to a particular network. Such means may include one or more of a tap, mirror or splitter.
  • According to a third aspect, there is provided a communications system comprising the module of the first aspect and/or the apparatus of the second aspect.
  • According to a fourth aspect, there is provided a method for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes, the method comprising receiving the plurality of signals over the network at an engine; extracting protocol data from the received signals and providing the extracted protocol data to an analyser; and controlling operation of the engine and analyser using a processor.
  • Preferably, the method comprises dividing the signals between a respective first node and second node into a plurality of planes and separately processing each plane. More preferably, the signals are divided into three planes. Namely, the planes defined in relation to the first aspect.
  • Preferably, the method comprises processing the user and/or network control signalling and the control information to control processing of the user plane traffic.
  • Preferably, each plane is processed substantially simultaneously.
  • Thus each signal of the second set of signals may be relayed to its corresponding destination through the module or apparatus of the invention in, or substantially in, real-time such that a user at the destination node is unaware of any delay. This is particularly important for lawful interception applications since it is vital that parties to the communications being monitored are unaware of the interceptions. More generally, though, it avoids inconveniencing users and loss of connections.
  • Preferably, the method comprises duplicating the plurality of signals to form two or more sets of substantially identical signals, wherein a first set of signals is processed according to the method of the fourth aspect and a second set of signals is transparently transported such that each signal is conveyed to its respective destination node.
  • Preferably, the method comprises extracting protocol data from each of the plurality of signals and forming an engine hash set or an engine CDC (Centrifuge Data Control) set for each said signal, each engine hash set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
  • The method may further comprise adding a weight, as described hereinabove in relation to the first aspect.
  • Preferably, the method comprises receiving one or more mode signals.
  • Preferably, a first set of control parameters is relayed from the processor to the analyser in response to a mode signal.
  • A second set of control parameters may be relayed from the analyser to the engine in response to the first set of control parameters or directly passed from the processor to the engine. Alternatively, the second set of control parameters may be relayed from the processor to the engine via the analyser, in which case, the analyser may modify the parameters prior to relaying them to the engine.
  • Preferably, operational parameters are extracted from a database in response to the first set of control parameters and/or the second set of control parameters.
  • According to one embodiment, a mode signal may indicate a lawful interception mode of operation and an identifier (or a plurality of identifiers) may be received identifying one or more signals to be intercepted.
  • Preferably, the one or more signals from the plurality of signals are located using the identifier and the extracted protocol data.
  • Preferably, the identifier is received from a database.
  • The identifier may be received directly from a user entry device directly or via the database.
  • Preferably, at least a portion of the intercepted signal and/or information obtained therefrom is stored and/or transmitted. Preferably, the at least a portion of the intercepted signal and/or information obtained therefrom is encrypted prior to transmission.
  • Preferably, the method comprises generating an analysis hash set for each signal to be intercepted, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set and/or the associated user traffic to the remote node.
  • According to another embodiment, a mode signal may indicate an information gathering mode, in which case, the method preferably comprises gathering information from at least a portion of the signals in response to the mode signal.
  • The gathering of information may be for billing purposes, in which case, details of the originating and/or destination nodes; and/or a duration of the communication and/or an amount of data exchanged between the two nodes; and/or a type or category of service information may be extracted. The information may be formatted for transmission and transmitted to a billing authority. Preferably, an analysis hash set is generated for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the billing authority.
  • Alternatively, the gathering of information may be for testing and/or diagnostic purposes, in which case, one or more statistics may be derived which relate to at least a portion of the signals. The information may be formatted for transmission and transmitted to a remote station. Preferably, an analysis hash set is generated for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash or data set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the remote station.
  • According to a fifth aspect, there is provided a method of generating communications to be sent to one or more destination nodes in a communications network, the method comprising transmitting control signals from a processor to an engine and/or an analyser, the engine being communicatively coupled to the analyser; and in response thereto, generating and routing communications to the destination nodes using parameters from the database by the engine and the analyser.
  • Preferably, the generating comprises generating protocol data for the communications based on the parameters, thereby enabling routing of the communications to their respective destination nodes.
  • Preferably, stored user traffic is used for the communications, wherein at least a portion of the user traffic is extracted and associated to each generated communication. Thus, it is possible to test a network or portions of the network to see how they handle real traffic previously communicated on that or another network, and to do so in real-time. It is therefore a straightforward matter to test the operation of a network during its infancy or when modifications are made.
  • Alternatively, the user traffic may be generated as required, either locally or remotely.
  • Preferably, an analysis hash set is generated for each communication in response to the control signals using parameters extracted from the database.
  • Preferably, engine hash sets are generated in response to the control signals and using the analysis hash sets.
  • Information regarding communications generated using the method of the fifth aspect may be gathered using the method of the fourth aspect.
  • Further aspects of the invention, which should be considered in all its novel aspects, will become apparent to those skilled in the art upon reading the following description which provides at least one example of a practical application of the invention.
  • BRIEF DESCRIPTION OF THE DRAWINGS
  • One or more embodiments of the invention will be described below by way of example only and without intending to be limiting with reference to the following drawings, in which:
  • FIG. 1 is a telecommunications architecture having three planes according to an embodiment of the invention;
  • FIG. 2 a is a schematic representation of a system of an embodiment of the invention;
  • FIG. 2 b is a schematic representation of a system of an embodiment of the invention, similar to that of FIG. 2 a but providing additional detail;
  • FIG. 3 is a schematic representation of a first module of the invention and its interface with a second module;
  • FIG. 4 is a schematic representation of a second module of the invention and its interfaces with the first module and a third module;
  • FIG. 5 is a schematic representation of the third module of the invention and its interfaces with a second module and end users; and
  • FIG. 6 is an end-to-end schematic representation of a system according to an embodiment of the invention.
  • DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
  • All service providers, including wired and/or wireless telecommunications companies (Telcos) and Internet service providers (ISPs), offer their subscribers many individually piped services and applications. As well as providing for the transfer of voice and/or data and/or information, authentication, billing and access to third-party application servers must also, for example, be performed. These services or applications may be integral to network switching and routing elements but the specific architecture and connecting technologies will depend on the Telco and the vendor equipment chosen.
  • Each application or service deployed by a service provider is made up of many protocol stacks. Each stack may be described in terms of the OSI reference model described hereinbefore. Between origination and destination nodes, each layer may be transformed or adapted depending on the service provider's architecture and the carrier technology deployed. There is a wide range of connecting technologies, interfaces and architectures to deliver a service provider's application, some based on standards and others proprietary to the vendor supplying the equipment or application involved. Thus, additional layers may be included and/or some layers of the OSI model may be altered or omitted.
  • Embodiments of the present invention provide apparatus, systems and methods that are able to operate in various environments and thereby enable service providers to move towards a more converged view whilst maintaining and supporting an existing customer base and legacy services. This is enabled using data obtained from the various OSI layers or protocol stacks which may be performed for any type of communication, as will become apparent from the description below. The physical location of the application of the present invention within a communications system or network depends on its particular use and deployment model. According to preferred embodiments, the engine is located at an access aggregation point on the access side of the core network such that there is access for the apparatus of the invention to all or a desired portion of communications in the network. Embodiments of the invention do not require changes to any of the hardware modules present in existing networks because whilst the module of the present invention may be included in an access aggregation point such as a switch, it is preferably provided upstream or downstream thereof so that it may receive all or a subset of the communications to and from the switch but does not require modifications to be made to the switch. Thus, embodiments of the present invention provide an application that is independent of vendor equipment, functionally holistic in access and core network switching technologies and capable of transparent, real-time operation.
  • FIG. 1 shows a telecommunications architecture 1 having three planes 12, 13, 14. In each plane 12, 13, 14, the standard OSI reference model may apply in whole or in part (i.e., all or a subset of the OSI layers may be used for each plane 12, 13, 14). Planes 12, 13, 14 are configured such that the user/network signalling, control data and user traffic may be carried over physically separate bearer and/or transport technologies. First plane 12 (shown in light blue in FIGS. 1 to 5) is responsible for user traffic such as voice, data, applications and services. Second plane 13 (shown in light green in FIGS. 1 to 5) is responsible for control data. Third plane 14 (shown in light orange in FIGS. 1 to 5) is responsible for transport or user/network signalling. All planes 12, 13, 14 work together simultaneously to enable communications to and from a user or subscriber device 15. Typically, each plane interacts with the others and this interaction has many interfaces, each with its own particular protocol stacks. The application logic of the present invention maintains state for processing between planes, interfaces and protocols.
  • In preferred embodiments, the invention processes user/network call signalling and control data, thereby permitting the tracking of, analysis on and potential subsequent action on user plane traffic. Thus, it is possible to focus processing on key portions of communications and to only expend significant processing power and communications bandwidth on user plane traffic when required. The invention finds particular application to lawful interception of communications involving an identifier such as that for a particular user, service or any other identifier that may be selected. The identifier may be compared with information in the control data plane 13 and/or user/network signalling plane 14, with operations (e.g. routing of the user plane traffic to a law enforcement agency) only being performed if required. Embodiments of the invention may also be used for data extraction purposes by identifying service users (such as calling and/or called parties in a telecommunications network), details of the communications (e.g. length of time for a communication and/or amount of data exchanged) and/or details of the type of service. The information obtained may be used for billing customers as well as in capacity planning and diagnostics. Capacity planning and diagnostics functionality may be provided using real communications over the network. However, embodiments of the invention provide for simulated call generation for this purpose so as to enable more rapid testing of network functionality. The call generation and data extraction functionalities are preferably provided in the same module using the same key components. However, the invention is not limited thereto and separate components may be used in the same module or separate modules may be used for each purpose.
  • The apparatus of the present invention is made up of three basic modules, an engine, an analyser and a processor, each of which may be implemented in hardware and/or software. The functions of each module are such that they support centralised or distributed processing, wherein the functions may be performed by a single element or split over a plurality of elements. The particular configuration selected is not material to the invention and the skilled man would be readily able to select a particular configuration depending on performance requirements. It is therefore intended that all such configurations be included within the scope of the invention.
  • Referring again to FIG. 1, to receive a service, subscriber 15 typically makes use of the service providers access, core and service applications networks 17, 18. This involves the use of several elements (shown as circles in the three layers) with interfaces therebetween. The real-time logic of the present invention understands the protocols between the various elements and extracts information therefrom. This is applied to processing for the user or service as required. Connections between plane elements are interfaces that consist of various physical interfaces and protocol stacks. Thus, the invention provides for a multi-protocol real-time switching and processing application for wireless and fixed access and core technologies. This provides service providers with direct real-time processing of all user activity and applications present on their network. This processing may be on a particular subscriber or on a service used by many subscribers.
  • FIG. 2 a shows a schematic representation of a system 20 according to an embodiment of the invention. As discussed above, the application of the invention comprises three modules. These are engine module 21, analysis module 22 and process module 23. The modules work together to provide carriers complete visibility of the user/network signalling and payload traffic flowing over their networks. Modules 21, 22 and 23 are communicatively coupled to database 24 which holds unique subscriber or application service identifiers. The real-time processing of the invention of access and core network interfaces and protocols allows for an array of user or service specific identifiers, such as telephone numbers, login names, Internet service provider (ISP) homepages etc. There are no restrictions on the form of the identifiers or the type of communication to which the invention may be applied. The identifiers may depend on the technology or may be common to the service. Also, embodiments of the invention are able to operate regardless of the vendor equipment deployed by a fixed and/or wireless carrier.
  • Engine module 21 applies fixed and wireline protocol analysis and creates hash sets of current subscriber calls application services and their particular states along with other information such as statistics to analysis module 22. Record sets provisioned in database 24 are used to determine which calls and application services are to be processed.
  • Similar to engine module 21, analysis module 22 implements fixed and wireless protocol stacks and is fully aware of processes occurring in all seven OSI layers. Analysis module 22 controls the processing logic within engine module 21 based on applications loaded in process module 23. Unlike engine module 21 which uses the actual signalling provided by the network, the protocol analysis performed by analysis module 22 works on the hash sets provided by engine module 21 which dramatically speeds up the switching and processing of user payloads. Analysis module 22 and engine module 21 work together providing a high-speed switching lane for user plane traffic.
  • Process module 23 provides instructions to analysis module 22 setting the functional characteristics thereof depending on the particular application of the invention. For example, for a capacity planning role (as will be discussed in more detail below), analysis module 22 and engine module 21 only require statistics to be recorded whereas in a lawful interception role, multimedia voice and data is switched in real-time through to the (law enforcement) agencies authorised to make the interceptions. Process module 23 also provides interfaces to the end user, carrier NOC (Network Operations Centre) or other control centre, and/or reporting servers, as applicable, whether data, media or reporting is delivered. Process module 23 has an administration interface whereby an operator can provision IDs or identifiers, URI's (Uniform Resource Identifier) application services (fixed or cellular) etc they would like to troubleshoot, analyse or receive in real-time.
  • FIG. 2 b is a schematic representation showing functionality according to a preferred embodiment of the invention. The module is preferably adapted to divide signals between a respective first node and second node into a plurality of planes and to separately process each plane. More preferably, signals are divided into three planes: transport, control and user planes.
  • The access side TRANSPORT plane carries the user's payload (sms, voice, video, internet data etc) to the carrier's CO exchange for switching and routing over the telco's network. eg: Radio link, phone line, DSL line, PABX trunks Ethernet etc. The module preferably simultaneously processes the transport layer on the access side of the network for call processing and the network side for internal management functions such as redundancy and system reliability.
  • The CONTROL plane includes call control information and/or network call signalling. The module processes the control plane on both the access and core networks, depending on the carrier and the user device.
  • The USER plane includes user plane traffic. This plane is primarily concerned with user generated content e.g. voice, data etc, but may contain call control signalling and/or network information generated by user applications, depending on service protocols. The module preferably processes the user plane on both the access and core networks.
  • The three planes are used to functionally group a particular signal's protocol layers. The planes are then preferably divided into two sections: access and core. The access section connects the user to the, for example, telco network (wireline, local loop, cellular, RAN etc) and the core section consists of the carriers' infrastructure switches. Particular call, session and/or user (including subscriber and/or device) identities may be generated and/or be simultaneously present in one or more of the three planes. The units of information processed in a plane may be referred to as a PDU or Plane Data Unit. Calls received which do not have the particular identity may be immediately discarded.
  • The PDU information content of each layer described above is only indicative of what would typically be expected and there is a high degree of overlap particularly between the CONTROL and USER planes, especially in wireless networks.
  • Preferably, the module engine applies a weight to the PDU to facilitate high speed processing efficiency, provide a mechanism for real-time adaptation of the executing engine code and ensure reliable content delivery.
  • Preferably, on a per call basis, each plane processes and assigns a weighting to the PDU (call component signalling) it receives and/or generates (depending on the mode of operation) in combination with the previous plane weighting (if present) and local system parameters which contribute to system processing. The PDU weighting reflects the section (access, core), wireless/fixed technology, handling complexity, density, payload QoS, system processing intensity etc. For traffic identified and not discarded and/or generated the module engine code cycle operation applies a native and very natural logical centrifugal force to the weighted PDU's. This force aligns the PDU with upper plane particular control processing such as exception handling or delivery routing changes for QoS to external systems. Details of a preferred weighting scheme are provided in FIG. 2 b. The skilled person will be aware of other weighting schemes and the invention is not limited to the specifics of the scheme shown.
  • The engine may extract protocol data from each signal (more particularly, each PDU) and form an engine CDC (Centrifuge Data Control) set or hash set for each said signal, each engine data set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic. The engine may then apply a weight to the PDU, as described hereinabove.
  • FIG. 3 is a schematic representation of engine module 21 and its interface with analysis module 22. Engine module 21 receives signals over any number of interfaces carrying user and/or network control and signalling and user traffic. These interfaces may be physical or logical. For example, they may be VPN (virtual private network) based with VPLS (virtual private LAN service) or MPLS (multiprotocol label switching) encapsulation. The physical transport to the apparatus of the invention may use copper-wire and/or optical fibres and may be adapted to receive and transmit or receive only. All forms of L1 and L2 encapsulation are supported. There is no limit to the call processing capabilities other than the switching and processing limits inherent of the platform on which the application of the invention resides. The engine is designed to process each layer of the particular protocol stack as efficiently as possible through the use of hash sets which are parsed versions of the protocol stacks associated with given communications.
  • Each physical connection contains interfaces having a specific inter-plane connection (see FIG. 1) or several interconnections. Interfaces may carry fixed and/or wireless protocol stacks, where the connection is specific to a particular fixed or wireless interface. For example, the Gn interface (a GPRS interface located between GPRS support nodes) is a specific UMTS access technology interface as per 3GPP, C7 ISUP (ISDN user part—a key protocol in the C7/SS7 signalling system) is common to both fixed and wireless access and core technologies. Engine module 21 provides the logic to correlate the common and specific interfaces and protocols and has logic to maintain the state between the interfaces and their layers such that communications continue to be relayed in a transparent manner.
  • The invention processes and parses the received fixed and wireless protocol stacks (starting at layer 1) in accordance with fixed and wireless protocol signalling standards such as for circuit ITU/ANSI C7 ISUP WB and international Q.769 and cell packet technologies ATM, DSL Frame Relay, IP, cellular etc.
  • Engine module 21 constructs hash sets (preferably one to two bytes in length but may be up to four bytes) for maintaining protocol and call state information. The hash sets are read and written to via bitwise logic operations and are produced on a per subscriber basis but may be consolidated based on application service, access technology, carrier technology etc. The relevant call signalling is extracted and maintained by way of the hash sets for the purpose of keeping state for subsequent logic. The length of the hash sets depends on the particular layer, interface and plane over which the signalling is occurring.
  • Engine hash sets are produced as a result of protocol analysis which requires particulars of the subscriber or service of interest. These particulars are provided in database 24 and can be changed at anytime during operation of the invention. The records stored in database 24 are of a nature that provides unique call/service identifiers which are groomed and applied to the protocol stacks relevant to the traffic on the inbound interfaces.
  • Engine module 21 provides common protocol stack switching whereby certain protocol layers are common to many stacks. For example, the HTTP protocol may be accessed via wireless (PDA) or fixed (broadband) networks and there is no need to duplicate this layer. Every layer is carefully maintained for state information and system maintenance purposes and to overcome access and transport connectivity issues such as packet loss and congestion which cause problems in terms of dormant sessions and memory loss.
  • The unique hash sets provide details on the current call state by consolidating details for each relevant interface participating in a particular call or calls, taking account of network congestion and retransmission algorithms and strategies, which is critical particularly for traffic inbound over lossy wireless access networks.
  • What information engine module 21 extracts depends on the technology employed at the particular layer. For example, fixed voice may be carried over different protocols (from layer 1 through to layer 6), but layer 7 is still voice (layer 1 could be an E1 or Ethernet)—it depends on the carrier infrastructure. It becomes more complex when wireless (GSM/UMTS (3GPP) vrs CDMA/EVDO (3GPP2)) functionality is added. Engine module 21 understands this variation on a per layer basis and tracks the changes in protocols (layer 1 through to layer 7). As a result of this variation the input to the hash sets may vary from protocol to protocol and could be atm/vpn identifiers through to session/sequence numbers and cryptographic hashes, basic information specific to the owner/generator/terminator of the communications stream, or simply data that helps in the reassembly of a fragmented traffic stream. The length of the hash sets may vary depending on what is being hashed and they contain bits to identify the protocol owner and stream information to aid in the multiplexing of real-time QoS (Quality of Service) aware traffic.
  • FIG. 4 is a schematic representation of analysis module 22 and its interfaces with engine module 21 and process module 23. Analysis module 22 controls the processing performed by engine module 21 in accordance with the service instructions received from process module 23. The instructions it receives depends on the particular application of the invention being performed on the selected call or service. Call and service specific details are read from database 24. Analysis module 23 provides information to process module 23, such as call service trace data and call statistics, as well as providing health of system and/or diagnostic data for system logs, alarming and maintenance purposes.
  • Analysis module 22 implements feed-forward towards process module 24 and feed-back towards engine module 21 with the particular information being passed depending on the particular application of the invention. Critical details required to support the particular application are provided in a memory such as database 24.
  • Call states are maintained through analysis hash sets which are based on the engine hash sets (i.e., the hash sets generated by engine module 21) and the instructions received from process module 23. Thus, the analysis hash sets may contain data from the engine hash sets as well as, for example, routing and control information to enable the desired function to be performed (e.g. the correct routing of data to a law enforcement agency when operating in the lawful interception mode or the forwarding of data to a local or remote memory when operating in a diagnostic mode).
  • Thus, analysis module 22 simply controls what engine module 21 is looking for in terms of relevant identifiers (whether these identifiers be for lawful interception, billing or other information gathering or call generation). This aids in the real-time multiplexing of media audio/video or any QoS aware traffic and the generation of the appropriate data, which again depends on carrier infrastructure and technologies.
  • FIG. 5 is a schematic representation of process module 23 and its interfaces with analysis module 22 and example end users. Process module 23 provides top level control for the invention in that it adapts and controls the behaviour of engine and analysis modules 21 and 22 depending on the particular application, such as traffic analysis, real time billing, lawful interception etc. Each specific application requires data configuration and details which are provided by database 24 which is preferably readable by all three modules 21, 22 and 23.
  • Process module 23 sends instructions to analysis module 22 for tuning and tailoring the protocol analysis stack function. As a result, analysis module 22 may similarly tune and tailor the function of engine module 21. The instructions are on a per call or service basis and do not apply in a global sense, thereby allowing the invention to perform multiple roles simultaneously without interference. For example, communications may be generated in a generation mode and substantially simultaneously recorded for statistical purposes in a capacity planning role.
  • Through use of the protocol hash sets generated by engine and analysis modules 21 and 22, the invention supports real time processing of various communications including standard PSTN voice traffic, soft switch based voice over IP technology and peer to peer technologies such as Skype and the like. An embodiment of the system showing such capabilities is provided in FIG. 6. Note that the skilled man would be aware of alternative/additional technologies and/or transport media which may be included (other than those specifically shown in FIG. 6) and it is intended that all such alternatives/additions be included within the scope of the invention.
  • FIG. 6 shows example system 60 including some of the inventive aspects of the invention, in particular, those relating to lawful interception of communications. Access network 61, wireless network 62 and fixed network 63 enable elements within system 60 to communicate with one another, as would be apparent to one of skill in the art. Other transmission media, including via satellites, are also within the scope of the invention. Module 64 of the invention receives all communications, or at least a copy thereof, being transferred across the network (note that reference “BXP” in FIG. 6 is used to highlight the key components of the invention). Relevant communications are intercepted and sent over, for example, virtual private network (VPN) 65 to a remote server 66. User interface 67 is provided to enable the results to be monitored and also to enable the provision of identifiers into the system so that particular communications may be targeted for interception. Note that server 66 and monitor 67 may be directly coupled to or integral to module 64.
  • An embodiment of the method of the invention will now be described with reference to FIG. 2 a. At step 0, the identifiers are loaded from database 24 and at step 1, protocol analysis is performed by engine 21 on incoming traffic to determine call technology and state. Hash sets are created for each communication and sent to analysis module 22. At step 2, analysis module 22 performs particular functions on the engine hash sets depending on instructions received from process module 23 and identifiers received from database 24. Based on call state data received from analysis module 22 and the particular role or application the system or method of the invention is selected to perform, further instructions are sent to analysis module 22 for execution at step 3. Analysis hash sets are created as a result of this processing. The analysis hash sets may be generated for all or a subset of the communications depending on the mode of operation of the invention. For example, in the lawful interception mode, analysis module 22 may identify relevant communications and only generate analysis hash sets for the identified communications. At step 4, analysis module 22 carries out any instructions received from process module 23. For example, the instructions may be to connect a high-speed switching socket for media relay or to save signalling and call statistics to a memory and/or a display (not shown). These instructions will depend on the particular role selected to be performed. The hash sets are modified to reflect these instructions.
  • Analysis module 22 may receive instructions to prioritise certain calls and/or services over others at step 5. Additionally, feedback is provided to engine 21 so that it works with maximum efficiency, such as by deploying ICMP (Internet Control Message Protocol) or ARP (Address Resolution Protocol) filters. At step 6, engine 21 applies protocol analysis for all OSI layers for every frame or cell. Certain protocols may be filtered for explicitly for either processing or to be dropped. Tuning instructions for engine 21 are provided by analysis module 22. The instructions received by engine 21 at step 7 may be to connect a high speed media lane to process module 23, in which case, the connections are made and user plane traffic is relayed through to its destination. The high speed media switching lane requires the use of both the engine and analysis hash sets to ensure that state is maintained for the communications and that they are correctly routed.
  • On receiving data reports, media etc at step 8 from engine 21 and analysis module 22, process module 23 cuts, for example, ASN.1 (Abstract Syntax Notation One) records with details regarding the call or application service for formal reporting into the business. ASN.1 is a formal notation used for describing data transmitted by telecommunications protocols, regardless of language implementation and physical representation of the data, whatever the application, whether complex or simple. It is a language for abstractly describing messages to be exchanged among an extensive range of applications involving the Internet, intelligent network, cellular phones, ground-to-air communications, electronic commerce, secure electronic services, interactive television, intelligent transportation systems, Voice Over IP and others. Analysis module 22 ensures that content reporting, multimedia, rtp, statistics etc are delivered to the provisioned end-point destinations. Receipt of all transactions and communications is preferably confirmed using protocols known to those of skill in the art.
  • Embodiments of the invention do not replace deployed network elements or systems but instead compliment existing systems by performing analysis and relay of traffic transparently (to the originating and destination nodes) and in real time. Thus, no requirements are imposed on the existing infrastructure allowing for deployment of the invention in existing systems.
  • Embodiments of the invention may not only be used for monitoring communications. Additionally or alternatively, embodiments of the invention may be used to generate communications. These embodiments are of particular value when combined with the monitoring systems described hereinbefore because this enables a service provider to quickly and easily test the capabilities of their systems under any desired conditions. Thus, embodiments of the invention may be used to rapidly test new components deployed in a communications network, thereby allowing them to become operational and an active part of the network more quickly but avoiding loss of any actual user traffic.
  • According to the communications generation aspects of the invention, the engine, analyser and processor work together to generate the communications. The processor provides control signals to the engine and/or the analyser, and in response thereto, the engine and the analyser generate and route communications to the desired destination nodes using parameters from a database, such as database 24 in FIG. 2 a. More particularly, the engine and the analyser generate protocol data for the communications based on the parameters which may include one or more of a username, an e-mail address, a telephone number, a unique device identifier or a type of device identifier. The parameters may also include particulars of the transmission medium. Thus, protocol stacks may be generated which enable transmission of the communications. These stacks may be formed by the analyser generating an analysis hash set for each communication in response to the control signals using parameters extracted from the database and the engine generating respective engine hash sets in response to the control signals and using the analysis hash sets, and possibly additional parameters retrieved from the database. A memory, such as database 24 of FIG. 2 a, may store sample user traffic which is appended to the communications. The user traffic may include voice and/or data traffic, applications or services. According to one embodiment, means are provided for generating the user traffic. The means for generating may be adapted to generate traffic in accordance with parameters previously monitored for the network or a similar network using the monitoring apparatus of the invention. Random generators may be used to mimic variations which are likely to occur within the network. Thus, it is possible to generate traffic which is similar to that which may actually be communicated over the network.
  • Thus, one or a plurality of communications streams may be set up between two or more real devices. Protocol layers (i.e., header/tail) are generated on a per call basis for the desired number of calls and technology (e.g. fixed/wireless, VoIP, SMS, PTT, voice, etc) and the payloads of the calls are multiplexed through to the destination system. Appropriate statistics and diagnostics can be performed in real-time or can be recorded for offline analysis of the carrier infrastructure and subsystems (e.g. transmission, billing, IN, etc).
  • Applications of the invention include:
      • real time ISP/telco applications or services troubleshooting on a per call or per service basis;
      • real time call traffic generation of user/network signalling and user traffic for the purpose of loading network/service elements—circuit and packet, fixed and cellular communications are supported;
      • real time billing record generation on a per call or per service basis;
      • real time viewing of network statistics; and
      • lawful interception in real time.
  • The invention is not limited to these applications and the skilled man may be aware of others. It is intended that all such applications be included within the scope of the invention whether they include the extraction of data regarding communications and/or the generation of communications in a communications network.
  • Unlike many previous arrangements, such as that described in US 2004/0165709, embodiments of the present invention are not limited to one particular type of communication over one particular portion of a network. For example, US 2004/0165709 is limited to a Telco's core IP network, with the interceptor limited to VoIP communications. Embodiments of the invention may process all types of communications on both the access and core networks, thereby guaranteeing interception of any target. The novel approach described herein enables this to be realised despite the potentially huge volumes of data being transported around a network and without causing delays in the transmission of traffic or storing data which is not being legitimately targeted.
  • Furthermore, contrary to prior approaches, embodiments of the invention provide for operation at layer 7, thereby enabling various components of the system to reliably communicate with one another. An additional advantage is that, for example, geographical redundancy may be provided, such as for a telephone number, since embodiments of the invention enable geographical restraints to be removed.
  • Various changes and modifications to the presently preferred embodiments described herein will be apparent to those skilled in the art. Such changes and modifications may be made without departing from the spirit and scope of the present invention and without diminishing its attendant advantages. It is therefore, intended that such changes and modifications be included within the present invention.

Claims (53)

1. A module for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes, the module comprising:
an engine for receiving the plurality of signals over the network, for extracting protocol data therefrom and for providing the extracted protocol data to an analyser; and
a processor for controlling operation of the engine and analyser.
2. The module of claim 1, adapted to divide signals between a respective first node and second node into a plurality of planes and to separately process each plane.
3. The module of claim 2, wherein the module is adapted to divide the signals into three planes.
4. The module of claim 3, wherein a first plane comprises the access side transport plane which carries a user's payload, and/or a second plane comprises control information and/or network call signalling, and/or a third plane comprises user plane traffic.
5-6. (canceled)
7. The module of claim 4, wherein the module is configured to process the user and/or network control signalling and the control information to control processing of the user plane traffic.
8. The module of claim 2, wherein each plane is processed substantially simultaneously.
9. The module of claim 1, further comprising means for duplicating said plurality of signals to form two sets of substantially identical signals.
10. (canceled)
11. The module of claim 9, wherein the engine is configured to receive the first set of said signals and/or transparently transport the second set of signals such that each signal of the second set is conveyed to its respective destination node.
12. (canceled)
13. The module of claim 1, wherein the engine is adapted to extract protocol data from each of the plurality of signals and to form an engine hash set for each said signal, each engine hash set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
14-15. (canceled)
16. The module of claim 1 or 9, wherein the processor is adapted to receive one or more mode signals which determine the functional characteristics of the module.
17. The module of claim 16, wherein the processor is adapted to receive a mode signal from a user entry device.
18. The module of claim 16, wherein the processor is adapted to relay a first set of control parameters to the analyser in response to a mode signal.
19. The module of claim 18, wherein the analyser is adapted to relay a second set of control parameters to the engine in response to the first set of control parameters.
20. The module of claim 16, wherein the processor is adapted to relay a second set of control parameters to the engine in response to a mode signal.
21. The module of claim 20, wherein the processor is adapted to relay the second set of control parameters to the engine via the analyser.
22. The module of claim 21, wherein the analyser is adapted to modify the second set of control parameters prior to relaying said parameters to the engine.
23. The module of claim 18, wherein the analyser is adapted to extract operational parameters from a database in response to the first set of control parameters.
24. The module of claim 19, wherein the engine is adapted to extract operational parameters from a database in response to the second set of control parameters.
25. The module of claim 16, wherein:
a mode signal indicates a lawful interception mode of operation; and
said module is adapted to receive an identifier identifying one or more signals to be intercepted.
26. The module of claim 25, wherein the analyser is configured to locate said one or more signals from the plurality of signals using the identifier and the extracted protocol data.
27. The module of claim 25, wherein the identifier comprises any one or more of a user identifier and/or a user device identifier associated with one or more of said signals, a telephone number, unique device or port identifier, username, login name, email address or a URL, a service identifier, or a category of service identifier.
28-30. (canceled)
31. The module of claim 25, adapted to receive the identifier from a database communicatively coupled or integral thereto or from a user entry device.
32-33. (canceled)
34. The module of claim 25, further comprising a memory for storing at least a portion of the intercepted signal and/or information obtained therefrom and/or a transmitter for transmitting at least a portion of the intercepted signal and/or information obtained therefrom to a remote node.
35-37. (canceled)
38. The module of claim 25 when dependent on claim 13, wherein the analyser is adapted to generate an analysis hash set for each signal to be intercepted, the analysis hash set comprising at least a portion of the engine hash set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set and/or the associated user traffic to the remote node.
39. The module of claim 16, wherein a mode signal indicates an information gathering mode of operation and in response to the mode signal, the analyser is configured to gather information from at least a portion of the signals.
40-41. (canceled)
42. The module of claim 39, wherein the analyser is configured to extract details of the originating and/or destination nodes; and/or a duration of the communication and/or an amount of data exchanged between the two nodes; and/or a type or category of service information.
43. The module of claim 42, wherein the analyser is adapted to format the information for transmission to a billing authority.
44. (canceled)
45. The module of claim 43 when dependent on claim 13, wherein the analyser is adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to the billing authority.
46. The module of claim 39, wherein the module is configured to gather information for testing and/or diagnostic purposes.
47. The module of claim 39, wherein the analyser is configured to derive one or more statistics relating to at least a portion of the signals.
48. (canceled)
49. The module of claim 46 when dependent on claim 13, wherein the analyser is adapted to generate an analysis hash set for each signal of the at least a portion of the signals, the analysis hash set comprising at least a portion of the engine hash set for the respective signal and control and/or transport information for enabling transfer of the analysis hash set to a remote station.
50-60. (canceled)
61. A method for use in a communications network in which a plurality of signals are transmitted between respective first and second nodes, the method comprising:
receiving the plurality of signals over the network at an engine;
extracting protocol data from the received signals and providing the extracted protocol data to an analyser; and
controlling operation of the engine and analyser using a processor.
62. The method of claim 61, further comprising dividing the signals between a respective first node and second node into a plurality of planes and separately processing each plane.
63. The method of claim 62, further comprising dividing the signals into three planes, a first plane comprising transport information, a second plane comprising control information and a third plane comprising user plane traffic.
64-69. (canceled)
70. The method of claim 61, comprising extracting protocol data by the engine from each of the plurality of signals and forming an engine hash set for each said signal, each engine hash set comprising information regarding user and/or transport and/or network signalling, control information and any user plane traffic.
71. The method of claim 61, further comprising receiving one or more mode signals at the processor.
72-78. (canceled)
79. The method of claim 71, wherein a mode signal indicates a lawful interception mode of operation, said method further comprising receiving an identifier identifying one or more signals to be intercepted and the one or more signals from the plurality of signals using the identifier and the extracted protocol data.
80-86. (canceled)
87. The method of claim 71, wherein a mode signal indicates an information gathering mode of operation and the method further comprising gathering information from at least a portion of the signals by the analyser in response to the mode signal.
88-103. (canceled)
US12/315,752 2007-05-14 2008-12-04 Methods, systems and apparatus for monitoring and/or generating communications in a communications network Expired - Fee Related US8179803B2 (en)

Applications Claiming Priority (6)

Application Number Priority Date Filing Date Title
WOPCT/NZ2007/000112 2007-05-14
NZPCT/NZ2007/000112 2007-05-14
PCT/NZ2007/000112 WO2008097105A1 (en) 2007-02-07 2007-05-14 Methods, systems and apparatus for monitoring and/or generating communications in a communications network
NZ553112 2008-02-07
PCT/NZ2008/000013 WO2008097107A1 (en) 2007-02-07 2008-02-07 Methods, systems and apparatus for monitoring and/or generating communications in a communications network
NZ55311208 2008-02-07

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
PCT/NZ2008/000013 Continuation WO2008097107A1 (en) 2007-02-07 2008-02-07 Methods, systems and apparatus for monitoring and/or generating communications in a communications network

Publications (2)

Publication Number Publication Date
US20090190479A1 true US20090190479A1 (en) 2009-07-30
US8179803B2 US8179803B2 (en) 2012-05-15

Family

ID=40899108

Family Applications (2)

Application Number Title Priority Date Filing Date
US12/315,753 Abandoned US20090196301A1 (en) 2007-05-14 2008-12-04 Methods, systems and apparatus for monitoring and/or generating communications in a communications network
US12/315,752 Expired - Fee Related US8179803B2 (en) 2007-05-14 2008-12-04 Methods, systems and apparatus for monitoring and/or generating communications in a communications network

Family Applications Before (1)

Application Number Title Priority Date Filing Date
US12/315,753 Abandoned US20090196301A1 (en) 2007-05-14 2008-12-04 Methods, systems and apparatus for monitoring and/or generating communications in a communications network

Country Status (1)

Country Link
US (2) US20090196301A1 (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110029667A1 (en) * 2008-02-21 2011-02-03 Telefonaktiebolaget L M Ericsson (Publ) Data Retention and Lawful Intercept for IP Services
US20150085670A1 (en) * 2013-09-24 2015-03-26 Subsentio, Inc. Lte probe
WO2015127984A1 (en) * 2014-02-28 2015-09-03 Telefonaktiebolaget L M Ericsson (Publ) Technique for call processing and analysis
US20160142273A1 (en) * 2010-06-08 2016-05-19 Verint Systems Ltd. Systems and methods for extracting media from network traffic having unknown protocols
US10397272B1 (en) * 2018-05-10 2019-08-27 Capital One Services, Llc Systems and methods of detecting email-based attacks through machine learning

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090196301A1 (en) * 2007-05-14 2009-08-06 Brian Parsons Methods, systems and apparatus for monitoring and/or generating communications in a communications network
CA2720873A1 (en) * 2008-04-07 2009-10-15 Amedeo Imbimbo Use of unique references to facilitate correlation of data retention or lawful interception records
CN102045148B (en) * 2009-10-16 2013-04-10 中国移动通信集团公司 Data transmission method and device based on relay mobile communication system
JP6864106B2 (en) 2017-02-21 2021-04-21 テレフオンアクチーボラゲット エルエム エリクソン(パブル) Methods and Devices for Dual Connectivity between Dual Protocol Stack User Equipment and Two Baseband Units in a Wireless Access Telecommunications Network

Citations (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5684954A (en) * 1993-03-20 1997-11-04 International Business Machine Corp. Method and apparatus for providing connection identifier by concatenating CAM's addresses at which containing matched protocol information extracted from multiple protocol header
US5913161A (en) * 1996-04-09 1999-06-15 Adc Telecommunications, Inc. Apparatus and methods for the lawful intercept of cellular communications
US20020078384A1 (en) * 1999-01-14 2002-06-20 Lassi Hippelainen Interception method and system
US20030082783A1 (en) * 2001-06-20 2003-05-01 Anderson Dirk M. Dendritic cell transmembrane serine protease
US20040073694A1 (en) * 2000-11-30 2004-04-15 Michael Frank Network resource allocation and monitoring system
US20040165709A1 (en) * 2003-02-24 2004-08-26 Pence Robert Leslie Stealth interception of calls within a VoIP network
US20050094651A1 (en) * 2003-10-30 2005-05-05 Alcatel Lawful interception gateway
US20060217156A1 (en) * 2005-03-23 2006-09-28 Nec Corporation Base station controller for radio communication network and method of collecting alarm information thereof
US20060223586A1 (en) * 2005-03-30 2006-10-05 Nec Corporation Transport resource control system and method, and radio network controller used in the same
US20060221829A1 (en) * 2005-03-21 2006-10-05 Tomas Holmstrom AUTOMATIC QoS CONFIGURATION
US20060262786A1 (en) * 2005-05-18 2006-11-23 Fujitsu Limited Inter-domain routing technique using MPLS
US20070106811A1 (en) * 2005-01-14 2007-05-10 Citrix Systems, Inc. Methods and systems for real-time seeking during real-time playback of a presentation layer protocol data stream
US20070121881A1 (en) * 2000-01-31 2007-05-31 Robert Pines Communication assistance system and method
US20070192863A1 (en) * 2005-07-01 2007-08-16 Harsh Kapoor Systems and methods for processing data flows
US20070212065A1 (en) * 2002-05-10 2007-09-13 Jong-Dug Shin Method and apparatus for supporting operations and maintenance functionality in an optical burst switching network
US20070217342A1 (en) * 2006-03-16 2007-09-20 Huawei Technologies Co., Ltd. Method and Apparatus for Security Protection of Service Interruption in Switch Network
US20080285452A1 (en) * 2007-05-14 2008-11-20 Cisco Technology, Inc. Remote monitoring of real-time internet protocol media streams
US20090040925A1 (en) * 2005-03-21 2009-02-12 Jarl Tomas Holmstrom DEVICE HAVING QUALITY OF SERVICE (QoS) CONFIRMATION AND METHOD FOR CONFIGURING QoS
US20090196301A1 (en) * 2007-05-14 2009-08-06 Brian Parsons Methods, systems and apparatus for monitoring and/or generating communications in a communications network
US7809827B1 (en) * 2006-05-12 2010-10-05 Juniper Networks, Inc. Network device having service card for lawful intercept and monitoring of packet flows

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI20001578A (en) * 2000-06-30 2001-12-31 Nokia Networks Oy QoS architecture
GB0117628D0 (en) * 2001-07-19 2001-09-12 Collins Mark A security system
US7447909B2 (en) 2003-06-05 2008-11-04 Nortel Networks Limited Method and system for lawful interception of packet switched network services

Patent Citations (20)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5684954A (en) * 1993-03-20 1997-11-04 International Business Machine Corp. Method and apparatus for providing connection identifier by concatenating CAM's addresses at which containing matched protocol information extracted from multiple protocol header
US5913161A (en) * 1996-04-09 1999-06-15 Adc Telecommunications, Inc. Apparatus and methods for the lawful intercept of cellular communications
US20020078384A1 (en) * 1999-01-14 2002-06-20 Lassi Hippelainen Interception method and system
US20070121881A1 (en) * 2000-01-31 2007-05-31 Robert Pines Communication assistance system and method
US20040073694A1 (en) * 2000-11-30 2004-04-15 Michael Frank Network resource allocation and monitoring system
US20030082783A1 (en) * 2001-06-20 2003-05-01 Anderson Dirk M. Dendritic cell transmembrane serine protease
US20070212065A1 (en) * 2002-05-10 2007-09-13 Jong-Dug Shin Method and apparatus for supporting operations and maintenance functionality in an optical burst switching network
US20040165709A1 (en) * 2003-02-24 2004-08-26 Pence Robert Leslie Stealth interception of calls within a VoIP network
US20050094651A1 (en) * 2003-10-30 2005-05-05 Alcatel Lawful interception gateway
US20070106811A1 (en) * 2005-01-14 2007-05-10 Citrix Systems, Inc. Methods and systems for real-time seeking during real-time playback of a presentation layer protocol data stream
US20060221829A1 (en) * 2005-03-21 2006-10-05 Tomas Holmstrom AUTOMATIC QoS CONFIGURATION
US20090040925A1 (en) * 2005-03-21 2009-02-12 Jarl Tomas Holmstrom DEVICE HAVING QUALITY OF SERVICE (QoS) CONFIRMATION AND METHOD FOR CONFIGURING QoS
US20060217156A1 (en) * 2005-03-23 2006-09-28 Nec Corporation Base station controller for radio communication network and method of collecting alarm information thereof
US20060223586A1 (en) * 2005-03-30 2006-10-05 Nec Corporation Transport resource control system and method, and radio network controller used in the same
US20060262786A1 (en) * 2005-05-18 2006-11-23 Fujitsu Limited Inter-domain routing technique using MPLS
US20070192863A1 (en) * 2005-07-01 2007-08-16 Harsh Kapoor Systems and methods for processing data flows
US20070217342A1 (en) * 2006-03-16 2007-09-20 Huawei Technologies Co., Ltd. Method and Apparatus for Security Protection of Service Interruption in Switch Network
US7809827B1 (en) * 2006-05-12 2010-10-05 Juniper Networks, Inc. Network device having service card for lawful intercept and monitoring of packet flows
US20080285452A1 (en) * 2007-05-14 2008-11-20 Cisco Technology, Inc. Remote monitoring of real-time internet protocol media streams
US20090196301A1 (en) * 2007-05-14 2009-08-06 Brian Parsons Methods, systems and apparatus for monitoring and/or generating communications in a communications network

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110029667A1 (en) * 2008-02-21 2011-02-03 Telefonaktiebolaget L M Ericsson (Publ) Data Retention and Lawful Intercept for IP Services
US9204293B2 (en) * 2008-02-21 2015-12-01 Telefonaktiebolaget L M Ericsson (Publ) Apparatuses, methods, and computer program products for data retention and lawful intercept for law enforcement agencies
US20160142273A1 (en) * 2010-06-08 2016-05-19 Verint Systems Ltd. Systems and methods for extracting media from network traffic having unknown protocols
US10547523B2 (en) * 2010-06-08 2020-01-28 Verint Systems Ltd. Systems and methods for extracting media from network traffic having unknown protocols
US20150085670A1 (en) * 2013-09-24 2015-03-26 Subsentio, Inc. Lte probe
WO2015127984A1 (en) * 2014-02-28 2015-09-03 Telefonaktiebolaget L M Ericsson (Publ) Technique for call processing and analysis
US20160373949A1 (en) * 2014-02-28 2016-12-22 Telefonaktiebolaget Lm Ericsson (Publ) Technique for call processing and analysis
US10015690B2 (en) * 2014-02-28 2018-07-03 Telefonaktiebolaget Lm Ericson (Publ) Technique for call processing and analysis
US10397272B1 (en) * 2018-05-10 2019-08-27 Capital One Services, Llc Systems and methods of detecting email-based attacks through machine learning
US20190349400A1 (en) * 2018-05-10 2019-11-14 Capital One Services, Llc Systems and methods of detecting email-based attacks through machine learning
US10805347B2 (en) * 2018-05-10 2020-10-13 Capital One Services, Llc Systems and methods of detecting email-based attacks through machine learning

Also Published As

Publication number Publication date
US20090196301A1 (en) 2009-08-06
US8179803B2 (en) 2012-05-15

Similar Documents

Publication Publication Date Title
US8179803B2 (en) Methods, systems and apparatus for monitoring and/or generating communications in a communications network
US7020130B2 (en) Method and apparatus for providing integrated voice and data services over a common interface device
US7188189B2 (en) System and method to improve the resiliency and performance of enterprise networks by utilizing in-built network redundancy
US9306816B2 (en) System and method for replaying network captures
US8514723B2 (en) Traffic monitoring by lowest transmission layer marking
US7254109B2 (en) Fault tolerant correlation engine method and system for telecommunications networks
CN103891249B (en) Method and apparatus for determining event instance
CN113169937B (en) Method, device, network node and medium for processing user data service
US20060227714A1 (en) Methods and systems for providing end-to-end testing of an IP-enabled network
US20070086336A1 (en) Application layer metrics monitoring
CN101632273A (en) Methods, systems, and computer program products for source-aware IP routing at a media gateway
AU2008258126B2 (en) Method, systems and apparatus for monitoring and/or generating communications in a communications network
US20150085670A1 (en) Lte probe
US8526470B2 (en) Synchronized commands for network testing
Nucci et al. Design, measurement and management of large-scale IP networks: Bridging the gap between theory and practice
US8707100B2 (en) Testing a network using randomly distributed commands
CA2997246A1 (en) Hybrid data transport solution, in particular for satellite links
USH2059H1 (en) System and method for managing terminal units in a wireless system
USH2072H1 (en) System and method for managing base stations in a wireless system
NZ573701A (en) Methods, systems and apparatus for monitoring and/or generating communications in a communications network
CN107846301A (en) A kind of teleservice test system and method
CN110880997A (en) Internet special line access system based on dynamic IP
CN109639911A (en) A kind of method, apparatus, equipment and storage medium triggering value-added service
Deri et al. Enterprise Voice-over-IP Traffic Monitoring
JP2004015736A (en) Communication system, band controller, and band control method

Legal Events

Date Code Title Description
AS Assignment

Owner name: ADVANCED MEDIA SYSTEMS LIMITED, NEW ZEALAND

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:PARSONS, BRIAN;REEL/FRAME:022499/0879

Effective date: 20090309

AS Assignment

Owner name: ADVANCED MEDIA SYSTEMS LIMITED, NEW ZEALAND

Free format text: CORRECTED RECORDATION FORM COVER SHEET TO CORRECT THE ATTORNEY DOCKET NUMBER IN REEL 022499 FRAME 0879.;ASSIGNOR:PARSONS, BRIAN;REEL/FRAME:022945/0303

Effective date: 20090309

Owner name: ADVANCED MEDIA SYSTEMS LIMITED, NEW ZEALAND

Free format text: CORRECTED RECORDATION FORM COVER SHEET TO CORRECT THE ATTORNEY DOCKET NUMBER IN REEL 022499 FRAME 0879;ASSIGNOR:PARSONS, BRIAN;REEL/FRAME:022945/0303

Effective date: 20090309

STCF Information on status: patent grant

Free format text: PATENTED CASE

REMI Maintenance fee reminder mailed
FPAY Fee payment

Year of fee payment: 4

SULP Surcharge for late payment
FEPP Fee payment procedure

Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

LAPS Lapse for failure to pay maintenance fees

Free format text: PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCH Information on status: patent discontinuation

Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362

FP Lapsed due to failure to pay maintenance fee

Effective date: 20200515